CVE-2023-45818

Cross-site Scripting vulnerability in TinyMCE undo/redo, getContent API, resetContent API, and Autosave plugin

Severity Score

6.1

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

Track

*SSVC

Descriptions

TinyMCE is an open source rich text editor. A mutation cross-site scripting (mXSS) vulnerability was discovered in TinyMCE’s core undo and redo functionality. When a carefully-crafted HTML snippet passes the XSS sanitisation layer, it is manipulated as a string by internal trimming functions before being stored in the undo stack. If the HTML snippet is restored from the undo stack, the combination of the string manipulation and reparative parsing by either the browser's native [DOMParser API](https://developer.mozilla.org/en-US/docs/Web/API/DOMParser) (TinyMCE 6) or the SaxParser API (TinyMCE 5) mutates the HTML maliciously, allowing an XSS payload to be executed. This vulnerability has been patched in TinyMCE 5.10.8 and TinyMCE 6.7.1 by ensuring HTML is trimmed using node-level manipulation instead of string manipulation. Users are advised to upgrade. There are no known workarounds for this vulnerability.

TinyMCE es un editor de texto enriquecido de código abierto. Se descubrió una vulnerabilidad de Cross-Site Scripting (XSS) en la funcionalidad principal de deshacer y rehacer de TinyMCE. Cuando un fragmento de HTML cuidadosamente manipulado pasa la capa de sanitización XSS, las funciones de recorte internas lo manipulan como una cadena antes de almacenarlo en la pila de deshacer. Si el fragmento HTML se restaura desde la pila de deshacer, la combinación de manipulación de cadenas y análisis reparativo mediante la [API DOMParser] nativa del navegador (https://developer.mozilla.org/en-US/docs/Web/API/ DOMParser) (TinyMCE 6) o la API SaxParser (TinyMCE 5) muta el HTML de forma maliciosa, permitiendo que se ejecute un payload XSS. Esta vulnerabilidad se ha solucionado en TinyMCE 5.10.8 y TinyMCE 6.7.1 garantizando que HTML se recorte mediante manipulación a nivel de nodo en lugar de manipulación de cadenas. Se recomienda a los usuarios que actualicen. No se conocen workarounds para esta vulnerabilidad.

*Credits: N/A

CVSS Scores

NISTv3.1 6.1

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:Track

Exploitation

None

Automatable

Tech. Impact

Partial

* Organization's Worst-case Scenario

Timeline

2023-10-13 CVE Reserved
2023-10-19 CVE Published
2024-09-12 CVE Updated
2024-09-18 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CAPEC

References (5)

URL	Tag	Source
https://researchgate.net/publication/266654651_mXSS_attacks_Attacking_well-secured_web-applications_by_using_innerHTML_mutations	Third Party Advisory
https://tiny.cloud/docs/release-notes/release-notes5108/#securityfixes	Release Notes
https://tiny.cloud/docs/tinymce/6/6.7.1-release-notes/#security-fixes	Release Notes
https://www.tiny.cloud/docs/api/tinymce.html/tinymce.html.saxparser	Product

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC
https://github.com/tinymce/tinymce/security/advisories/GHSA-v65r-p3vv-jjfv	2023-10-26

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Tiny Search vendor "Tiny"		Tinymce Search vendor "Tiny" for product "Tinymce"				< 5.10.8 Search vendor "Tiny" for product "Tinymce" and version " < 5.10.8"		-		Affected
Tiny Search vendor "Tiny"		Tinymce Search vendor "Tiny" for product "Tinymce"				>= 6.0.0 < 6.7.1 Search vendor "Tiny" for product "Tinymce" and version " >= 6.0.0 < 6.7.1"		-		Affected