CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 0CVE-2023-45818 – Cross-site Scripting vulnerability in TinyMCE undo/redo, getContent API, resetContent API, and Autosave plugin
https://notcve.org/view.php?id=CVE-2023-45818
TinyMCE is an open source rich text editor. A mutation cross-site scripting (mXSS) vulnerability was discovered in TinyMCE’s core undo and redo functionality. When a carefully-crafted HTML snippet passes the XSS sanitisation layer, it is manipulated as a string by internal trimming functions before being stored in the undo stack. If the HTML snippet is restored from the undo stack, the combination of the string manipulation and reparative parsing by either the browser's native [DOMParser API](https://developer.mozilla.org/en-US/docs/Web/API/DOMParser) (TinyMCE 6) or the SaxParser API (TinyMCE 5) mutates the HTML maliciously, allowing an XSS payload to be executed. This vulnerability has been patched in TinyMCE 5.10.8 and TinyMCE 6.7.1 by ensuring HTML is trimmed using node-level manipulation instead of string manipulation. • https://github.com/tinymce/tinymce/security/advisories/GHSA-v65r-p3vv-jjfv https://researchgate.net/publication/266654651_mXSS_attacks_Attacking_well-secured_web-applications_by_using_innerHTML_mutations https://tiny.cloud/docs/release-notes/release-notes5108/#securityfixes https://tiny.cloud/docs/tinymce/6/6.7.1-release-notes/#security-fixes https://www.tiny.cloud/docs/api/tinymce.html/tinymce.html.saxparser • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 0CVE-2023-45819 – Cross-site Scripting vulnerability in TinyMCE notificationManager.open API
https://notcve.org/view.php?id=CVE-2023-45819
TinyMCE is an open source rich text editor. A cross-site scripting (XSS) vulnerability was discovered in TinyMCE’s Notification Manager API. The vulnerability exploits TinyMCE's unfiltered notification system, which is used in error handling. The conditions for this exploit requires carefully crafted malicious content to have been inserted into the editor and a notification to have been triggered. When a notification was opened, the HTML within the text argument was displayed unfiltered in the notification. • https://github.com/tinymce/tinymce/security/advisories/GHSA-hgqx-r2hp-jr38 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 0CVE-2022-23494 – Cross-site scripting vulnerability in TinyMCE alerts
https://notcve.org/view.php?id=CVE-2022-23494
tinymce is an open source rich text editor. A cross-site scripting (XSS) vulnerability was discovered in the alert and confirm dialogs when these dialogs were provided with malicious HTML content. This can occur in plugins that use the alert or confirm dialogs, such as in the `image` plugin, which presents these dialogs when certain errors occur. The vulnerability allowed arbitrary JavaScript execution when an alert presented in the TinyMCE UI for the current user. This vulnerability has been patched in TinyMCE 5.10.7 and TinyMCE 6.3.1 by ensuring HTML sanitization was still performed after unwrapping invalid elements. • https://github.com/tinymce/tinymce/commit/6923d85eba6de3e08ebc9c5a387b5abdaa21150e https://github.com/tinymce/tinymce/commit/8bb2d2646d4e1a718fce61a775fa22e9d317b32d https://github.com/tinymce/tinymce/security/advisories/GHSA-gg8r-xjwq-4w92 https://www.tiny.cloud/docs/release-notes/release-notes5107/#securityfixes https://www.tiny.cloud/docs/tinymce/6/6.3-release-notes/#security-fixes https://www.tiny.cloud/docs/tinymce/6/file-image-upload/#images_upload_handler • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •