GHSA-wqm8-jx8r-8rcq json
Cross-site scripting vulnerabilities in old version of bundled TinyMCE
published 3y ago modified last yr.
- cvss
- 5.4
- version 3.1, GitHub
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- —
- no score, EPSS covers CVEs only
- public exploits
- 0
- none known
Summary
An old version of TinyMCE include an XSS vulnerability, which was patched in a later version. This was described by TinyMCE:
> A cross-site scripting (XSS) vulnerability was discovered in the core parser. The vulnerability allowed arbitrary JavaScript execution when inserting a specially crafted piece of content into the editor via the clipboard or APIs. This impacts all users who are using TinyMCE 4.9.10 or lower and TinyMCE 5.4.0 or lower.
We reviewed the potential impact of this vulnerability within the context of Silverstripe CMS. We concluded this is a medium impact vulnerability given how TinyMCE is used by Silverstripe CMS.
Reported by: Developers at ACC
Patch / fix
- packagist silverstripe/admin 1.12.7
Is GHSA-wqm8-jx8r-8rcq in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| GitHub | 3.1 | 5.4 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | silverstripe/admin | <1.12.7 |
1.12.7 |
References
-
github.com
/silverstripe/silverstripe-admin/security/advisories/GHSA-wqm8-jx8r-8rcq
web
-
github.com
/FriendsOfPHP/security-advisories/blob/master/silverstripe/admin/SS-2023-001.yaml
web
-
github.com
/advisories/GHSA-vrv8-v4w8-f95h
advisory
-
github.com
/silverstripe/silverstripe-admin
package
-
silverstripe.org
/download/security-releases/ss-2023-001
web
-
tiny.cloud
/docs/release-notes/release-notes54/#securityfixes
web
Sources
- GitHub Advisory GHSA-wqm8-jx8r-8rcq
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.