CVE-2020-12648

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2020-12648

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-12648.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2020-12648

Aliases

GHSA-vrv8-v4w8-f95h

Downstream

UBUNTU-CVE-2020-12648

Published

2020-08-14T14:15:12.410Z

Modified

2026-07-08T19:02:24.870700Z

Severity

6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator

Summary

[none]

Details

A cross-site scripting (XSS) vulnerability in TinyMCE 5.2.1 and earlier allows remote attackers to inject arbitrary web script when configured in classic editing mode.

References

https://labs.bishopfox.com/advisories/tinymce-version-5.2.1

Affected packages

Git / github.com/tinymce/tinymce

Affected ranges

Type

GIT

Repo

https://github.com/tinymce/tinymce

Events

Introduced

Fixed

d79205cbe7d9f74e2ca287ee4e7dee3c32138b5b

Introduced

945bf35afd18fe97415652ae026b538ea7ffa8b8

Fixed

36f32935d63d0d8bf30e3f42578e3a693ddc9673

Database specific

{
    "cpe": "cpe:2.3:a:tiny:tinymce:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "4.9.11"
        },
        {
            "introduced": "5.0.0"
        },
        {
            "fixed": "5.4.1"
        }
    ],
    "source": "CPE_RANGE"
}

Affected versions

2.*

2.0.7

2.0.9

2.1.1

2.1.2

3.*

3.0

3.0.1

3.0.2

3.0.2.1

3.0.3

3.0.4

3.0.5

3.0.6

3.0.7

3.0.9

3.0rc1

3.0rc2

3.1.0

3.2

3.2.0.2

3.2.1

3.2.1.1

3.2.2

3.2.2.1

3.2.2.2

3.2.3

3.2.6

3.2.7

3.3

3.3.1

3.3.2

3.3.3

3.3.4

3.3.5

3.3.6

3.3.7

3.3.8

3.3.9

3.3.9.1

3.3.9.2

3.3b1

3.3b2

3.3rc1

3.4

3.4.1

3.4.2

3.4.3

3.4.3.1

3.4.3.2

3.4.4

3.4.5

3.4.6

3.4.7

3.4.8

3.4.9

3.4b1

3.4b2

3.4b3

3.5

3.5.0.1

3.5.1

3.5.1.1

3.5.2

3.5.3

3.5.3.1

3.5.4

3.5.4.1

3.5.5

3.5.6

3.5.7

3.5.8

4.*

4.0

4.0.1

4.0.10

4.0.11

4.0.12

4.0.13

4.0.14

4.0.15

4.0.16

4.0.17

4.0.18

4.0.19

4.0.2

4.0.20

4.0.21

4.0.22

4.0.23

4.0.24

4.0.25

4.0.26

4.0.27

4.0.28

4.0.3

4.0.4

4.0.5

4.0.6

4.0.7

4.0.8

4.0.9

4.0b1

4.0b2

4.0b3

4.1.0

4.1.1

4.1.10

4.1.2

4.1.3

4.1.4

4.1.5

4.1.6

4.1.7

4.1.8

4.1.9

4.2.0

4.2.1

4.2.2

4.2.3

4.2.4

4.2.5

4.2.6

4.2.7

4.3.0

4.3.1

4.3.10

4.3.11

4.3.12

4.3.13

4.3.2

4.3.3

4.3.4

4.3.6

4.3.7

4.3.8

4.3.9

4.4.0

4.4.1

4.4.2

4.4.3

4.5.0

4.5.1

4.5.2

4.5.3

4.6.0

4.6.1

4.6.2

4.6.3

4.6.4

4.6.5

4.6.6

4.6.7

4.7.0

4.7.1

4.7.10

4.7.11

4.7.12

4.7.13

4.7.2

4.7.3

4.7.4

4.7.5

4.7.6

4.7.7

4.7.8

4.7.9

4.8.0

4.8.1

4.8.2

4.8.3

4.8.4

4.8.5

4.9.0

4.9.1

4.9.10

4.9.2

4.9.3

4.9.4

4.9.5

4.9.6

4.9.7

4.9.8

4.9.9

5.*

5.0.14

5.0.15

5.3.0

5.4.0

5.5.0

5.5.1

5.6.0

5.7.0

5.7.1

5.8.0

5.8.1

5.8.2

@ephox/acid@1.*

@ephox/acid@1.0.34

@ephox/acid@1.0.35

@ephox/acid@1.0.36

@ephox/acid@1.0.37

@ephox/acid@1.0.38

@ephox/acid@1.0.39

@ephox/acid@1.0.40

@ephox/acid@1.0.41

@ephox/acid@1.0.42

@ephox/acid@1.0.43

@ephox/acid@1.0.44

@ephox/acid@1.0.45

@ephox/acid@1.0.75

@ephox/acid@1.0.78

@ephox/acid@2.*

@ephox/acid@2.0.1

@ephox/acid@2.0.3

@ephox/acid@2.0.5

@ephox/acid@3.*

@ephox/acid@3.0.1

@ephox/acid@3.0.2

@ephox/acid@3.0.3

@ephox/acid@3.0.4

@ephox/agar@4.*

@ephox/agar@4.13.22

@ephox/agar@4.13.23

@ephox/agar@4.13.24

@ephox/agar@4.13.25

@ephox/agar@4.13.26

@ephox/agar@4.13.27

@ephox/agar@4.13.28

@ephox/agar@4.13.29

@ephox/agar@4.13.30

@ephox/agar@4.13.31

@ephox/agar@4.13.32

@ephox/agar@4.13.33

@ephox/agar@4.15.5

@ephox/agar@4.16.1

@ephox/agar@5.*

@ephox/agar@5.0.1

@ephox/agar@5.1.1

@ephox/agar@5.2.1

@ephox/agar@5.3.1

@ephox/agar@5.3.2

@ephox/agar@5.3.3

@ephox/agar@5.4.0

@ephox/alloy@4.*

@ephox/alloy@4.15.10

@ephox/alloy@4.15.11

@ephox/alloy@4.15.12

@ephox/alloy@4.15.13

@ephox/alloy@4.15.14

@ephox/alloy@4.15.15

@ephox/alloy@4.15.16

@ephox/alloy@4.15.17

@ephox/alloy@4.15.6

@ephox/alloy@4.15.7

@ephox/alloy@4.15.8

@ephox/alloy@4.15.9

@ephox/alloy@7.*

@ephox/alloy@7.0.1

@ephox/alloy@7.0.4

@ephox/alloy@8.*

@ephox/alloy@8.0.1

@ephox/alloy@8.1.1

@ephox/alloy@8.1.3

@ephox/alloy@8.2.1

@ephox/alloy@8.2.2

@ephox/alloy@8.2.3

@ephox/alloy@8.2.4

@ephox/boss@3.*

@ephox/boss@3.0.30

@ephox/boss@3.0.31

@ephox/boss@3.0.32

@ephox/boss@3.0.33

@ephox/boss@3.0.34

@ephox/boss@3.0.35

@ephox/boss@3.0.36

@ephox/boss@3.0.37

@ephox/boss@3.1.5

@ephox/boss@3.1.7

@ephox/boss@4.*

@ephox/boss@4.0.1

@ephox/boss@4.0.3

@ephox/boss@4.1.1

@ephox/boss@4.1.3

@ephox/boss@4.2.0

@ephox/boulder@3.*

@ephox/boulder@3.3.26

@ephox/boulder@3.3.27

@ephox/boulder@3.3.28

@ephox/boulder@3.3.29

@ephox/boulder@4.*

@ephox/boulder@4.0.5

@ephox/boulder@4.0.7

@ephox/boulder@5.*

@ephox/boulder@5.0.1

@ephox/boulder@5.0.3

@ephox/boulder@5.0.5

@ephox/boulder@5.0.7

@ephox/bridge@1.*

@ephox/bridge@1.0.74

@ephox/bridge@1.0.75

@ephox/bridge@1.0.76

@ephox/bridge@1.0.77

@ephox/bridge@1.0.78

@ephox/bridge@1.2.1

@ephox/bridge@1.2.3

@ephox/bridge@2.*

@ephox/bridge@2.0.1

@ephox/bridge@2.1.1

@ephox/bridge@2.1.3

@ephox/bridge@2.2.0

@ephox/bridge@2.2.2

@ephox/darwin@3.*

@ephox/darwin@3.0.25

@ephox/darwin@3.0.26

@ephox/darwin@3.0.27

@ephox/darwin@3.0.28

@ephox/darwin@3.0.29

@ephox/darwin@3.0.30

@ephox/darwin@3.0.31

@ephox/darwin@3.0.32

@ephox/darwin@4.*

@ephox/darwin@4.0.16

@ephox/darwin@4.0.18

@ephox/darwin@5.*

@ephox/darwin@5.0.1

@ephox/darwin@5.0.2

@ephox/darwin@5.0.4

@ephox/darwin@6.*

@ephox/darwin@6.0.1

@ephox/darwin@6.0.3

@ephox/darwin@6.0.4

@ephox/darwin@6.0.5

@ephox/darwin@6.0.6

@ephox/dragster@4.*

@ephox/dragster@4.0.22

@ephox/dragster@4.0.23

@ephox/dragster@4.0.24

@ephox/dragster@4.0.25

@ephox/dragster@4.0.26

@ephox/dragster@4.0.27

@ephox/dragster@4.0.28

@ephox/dragster@4.0.29

@ephox/dragster@4.0.48

@ephox/dragster@4.0.50

@ephox/dragster@5.*

@ephox/dragster@5.0.1

@ephox/dragster@5.0.3

@ephox/dragster@5.0.5

@ephox/dragster@5.0.7

@ephox/imagetools@3.*

@ephox/imagetools@3.3.1

@ephox/imagetools@3.3.3

@ephox/imagetools@4.*

@ephox/imagetools@4.0.1

@ephox/imagetools@4.0.3

@ephox/imagetools@4.0.5

@ephox/imagetools@4.0.7

@ephox/jax@4.*

@ephox/jax@4.1.17

@ephox/jax@4.1.18

@ephox/jax@4.1.19

@ephox/jax@4.1.20

@ephox/jax@4.1.33

@ephox/jax@4.1.35

@ephox/jax@5.*

@ephox/jax@5.0.1

@ephox/jax@5.0.3

@ephox/jax@5.0.5

@ephox/jax@5.0.7

@ephox/katamari-assertions@1.*

@ephox/katamari-assertions@1.0.6

@ephox/katamari-assertions@1.0.8

@ephox/katamari-assertions@2.*

@ephox/katamari-assertions@2.0.1

@ephox/katamari-assertions@2.0.3

@ephox/katamari-assertions@2.0.5

@ephox/katamari-assertions@2.0.7

@ephox/katamari@2.*

@ephox/katamari@2.4.28

@ephox/katamari@2.5.0

@ephox/katamari@2.5.1

@ephox/katamari@2.5.2

@ephox/katamari@6.*

@ephox/katamari@6.0.1

@ephox/katamari@6.1.1

@ephox/katamari@7.*

@ephox/katamari@7.0.1

@ephox/katamari@7.1.1

@ephox/katamari@7.1.3

@ephox/katamari@7.2.1

@ephox/mcagar@4.*

@ephox/mcagar@4.0.21

@ephox/mcagar@4.0.22

@ephox/mcagar@4.0.23

@ephox/mcagar@4.0.24

@ephox/mcagar@4.0.25

@ephox/mcagar@4.0.26

@ephox/mcagar@4.0.27

@ephox/mcagar@4.0.28

@ephox/mcagar@4.0.29

@ephox/mcagar@4.0.30

@ephox/mcagar@4.0.31

@ephox/mcagar@4.0.32

@ephox/mcagar@4.1.6

@ephox/mcagar@4.2.1

@ephox/mcagar@5.*

@ephox/mcagar@5.0.1

@ephox/mcagar@5.1.1

@ephox/mcagar@6.*

@ephox/mcagar@6.0.1

@ephox/mcagar@6.1.1

@ephox/mcagar@6.1.2

@ephox/mcagar@6.1.3

@ephox/mcagar@6.1.4

@ephox/phoenix@5.*

@ephox/phoenix@5.0.32

@ephox/phoenix@5.0.33

@ephox/phoenix@5.0.34

@ephox/phoenix@5.0.35

@ephox/phoenix@5.0.36

@ephox/phoenix@5.0.37

@ephox/phoenix@5.0.38

@ephox/phoenix@5.0.39

@ephox/phoenix@5.1.6

@ephox/phoenix@5.1.8

@ephox/phoenix@6.*

@ephox/phoenix@6.0.1

@ephox/phoenix@6.0.3

@ephox/phoenix@6.0.5

@ephox/phoenix@6.0.7

@ephox/phoenix@6.0.8

@ephox/phoenix@6.0.9

@ephox/polaris@3.*

@ephox/polaris@3.0.32

@ephox/polaris@3.0.33

@ephox/polaris@3.0.34

@ephox/polaris@3.0.35

@ephox/polaris@3.0.50

@ephox/polaris@3.0.52

@ephox/polaris@4.*

@ephox/polaris@4.0.1

@ephox/polaris@4.0.3

@ephox/polaris@4.0.5

@ephox/polaris@4.0.7

@ephox/polaris@4.0.8

@ephox/porkbun@4.*

@ephox/porkbun@4.0.19

@ephox/porkbun@4.0.20

@ephox/porkbun@4.0.21

@ephox/porkbun@4.0.22

@ephox/porkbun@4.0.35

@ephox/porkbun@4.0.37

@ephox/porkbun@5.*

@ephox/porkbun@5.0.1

@ephox/porkbun@5.0.3

@ephox/porkbun@5.0.5

@ephox/porkbun@5.0.7

@ephox/robin@7.*

@ephox/robin@7.0.26

@ephox/robin@7.0.27

@ephox/robin@7.0.28

@ephox/robin@7.0.29

@ephox/robin@7.0.30

@ephox/robin@7.0.31

@ephox/robin@7.0.32

@ephox/robin@7.0.33

@ephox/robin@7.0.53

@ephox/robin@7.0.55

@ephox/robin@8.*

@ephox/robin@8.0.1

@ephox/robin@8.0.2

@ephox/robin@8.0.4

@ephox/robin@8.0.6

@ephox/robin@8.0.8

@ephox/robin@8.0.9

@ephox/robin@8.1.0

@ephox/sand@3.*

@ephox/sand@3.0.3

@ephox/sand@3.0.4

@ephox/sand@3.0.5

@ephox/sand@3.0.6

@ephox/sand@3.1.10

@ephox/sand@3.1.8

@ephox/sand@4.*

@ephox/sand@4.0.1

@ephox/sand@4.0.3

@ephox/sand@4.0.5

@ephox/sand@4.0.7

@ephox/snooker@5.*

@ephox/snooker@5.0.10

@ephox/snooker@5.0.3

@ephox/snooker@5.0.4

@ephox/snooker@5.0.5

@ephox/snooker@5.0.6

@ephox/snooker@5.0.7

@ephox/snooker@5.0.8

@ephox/snooker@5.0.9

@ephox/snooker@5.1.14

@ephox/snooker@6.*

@ephox/snooker@6.0.1

@ephox/snooker@7.*

@ephox/snooker@7.0.1

@ephox/snooker@7.0.2

@ephox/snooker@7.1.1

@ephox/snooker@8.*

@ephox/snooker@8.0.1

@ephox/snooker@8.0.3

@ephox/snooker@8.0.4

@ephox/snooker@8.0.5

@ephox/snooker@8.0.6

@ephox/sugar@5.*

@ephox/sugar@5.0.0

@ephox/sugar@5.0.1

@ephox/sugar@5.0.2

@ephox/sugar@5.0.3

@ephox/sugar@5.0.4

@ephox/sugar@5.0.5

@ephox/sugar@5.0.6

@ephox/sugar@5.0.7

@ephox/sugar@6.*

@ephox/sugar@6.0.1

@ephox/sugar@6.1.1

@ephox/sugar@7.*

@ephox/sugar@7.0.1

@ephox/sugar@7.0.3

@ephox/sugar@7.1.1

@ephox/sugar@7.1.3

@tinymce/oxide-icons-default@1.*

@tinymce/oxide-icons-default@1.3.3

@tinymce/oxide-icons-default@1.4.1

@tinymce/oxide-icons-default@1.5.1

@tinymce/oxide@1.*

@tinymce/oxide@1.0.233

@tinymce/oxide@1.0.234

@tinymce/oxide@1.0.235

@tinymce/oxide@1.0.236

@tinymce/oxide@1.3.1

@tinymce/oxide@1.4.1

@tinymce/oxide@1.5.1

@tinymce/oxide@1.6.1

@tinymce/oxide@1.7.1

@tinymce/oxide@1.8.1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-12648.json"