CVE-2020-17480

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2020-17480
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-17480.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2020-17480
Aliases
Downstream
Related
Published
2020-08-10T20:15:11.737Z
Modified
2026-03-13T22:01:39.374715Z
Severity
  • 6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
Summary
[none]
Details

TinyMCE before 4.9.7 and 5.x before 5.1.4 allows XSS in the core parser, the paste plugin, and the visualchars plugin by using the clipboard or APIs to insert content into the editor.

References

Affected packages

Git / github.com/tinymce/tinymce

Affected ranges

Type
GIT
Repo
https://github.com/tinymce/tinymce
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
615f7e7a2b4beb7445fe9dc416b9ccaec646c2f0
Introduced
945bf35afd18fe97415652ae026b538ea7ffa8b8
Fixed
cd7b9a213076a7c2cd1721d82e59ee974d536920
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "4.9.7"
        },
        {
            "introduced": "5.0.0"
        },
        {
            "fixed": "5.1.4"
        }
    ]
}

Affected versions

5.*
5.0.14
5.0.15
5.0.16
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
@ephox/acid@1.*
@ephox/acid@1.0.34
@ephox/acid@1.0.35
@ephox/acid@1.0.36
@ephox/acid@1.0.37
@ephox/acid@1.0.38
@ephox/acid@1.0.39
@ephox/acid@1.0.40
@ephox/acid@1.0.41
@ephox/acid@1.0.42
@ephox/acid@1.0.43
@ephox/acid@1.0.44
@ephox/acid@1.0.45
@ephox/acid@1.0.46
@ephox/acid@1.0.48
@ephox/acid@1.0.50
@ephox/acid@1.0.51
@ephox/acid@1.0.52
@ephox/acid@1.0.53
@ephox/acid@1.0.54
@ephox/acid@1.0.55
@ephox/acid@1.0.56
@ephox/acid@1.0.57
@ephox/acid@1.0.58
@ephox/acid@1.0.59
@ephox/acid@1.0.60
@ephox/acid@1.0.61
@ephox/acid@1.0.62
@ephox/acid@1.0.63
@ephox/agar@4.*
@ephox/agar@4.13.22
@ephox/agar@4.13.23
@ephox/agar@4.13.24
@ephox/agar@4.13.25
@ephox/agar@4.13.26
@ephox/agar@4.13.27
@ephox/agar@4.13.28
@ephox/agar@4.13.29
@ephox/agar@4.13.30
@ephox/agar@4.13.31
@ephox/agar@4.13.32
@ephox/agar@4.13.33
@ephox/agar@4.13.34
@ephox/agar@4.13.36
@ephox/agar@4.13.38
@ephox/agar@4.13.39
@ephox/agar@4.13.40
@ephox/agar@4.13.41
@ephox/agar@4.14.0
@ephox/agar@4.14.1
@ephox/agar@4.14.2
@ephox/agar@4.14.3
@ephox/agar@4.14.4
@ephox/agar@4.14.5
@ephox/agar@4.14.6
@ephox/alloy@4.*
@ephox/alloy@4.15.10
@ephox/alloy@4.15.11
@ephox/alloy@4.15.12
@ephox/alloy@4.15.13
@ephox/alloy@4.15.14
@ephox/alloy@4.15.15
@ephox/alloy@4.15.16
@ephox/alloy@4.15.17
@ephox/alloy@4.15.18
@ephox/alloy@4.15.20
@ephox/alloy@4.15.22
@ephox/alloy@4.15.23
@ephox/alloy@4.15.24
@ephox/alloy@4.15.25
@ephox/alloy@4.15.26
@ephox/alloy@4.15.27
@ephox/alloy@4.15.6
@ephox/alloy@4.15.7
@ephox/alloy@4.15.8
@ephox/alloy@4.15.9
@ephox/alloy@5.*
@ephox/alloy@5.0.0
@ephox/alloy@5.0.1
@ephox/alloy@5.0.2
@ephox/alloy@5.0.3
@ephox/alloy@5.0.4
@ephox/alloy@5.0.5
@ephox/alloy@5.0.6
@ephox/alloy@5.0.7
@ephox/boss@3.*
@ephox/boss@3.0.30
@ephox/boss@3.0.31
@ephox/boss@3.0.32
@ephox/boss@3.0.33
@ephox/boss@3.0.34
@ephox/boss@3.0.35
@ephox/boss@3.0.36
@ephox/boss@3.0.37
@ephox/boss@3.0.39
@ephox/boss@3.0.41
@ephox/boss@3.0.42
@ephox/boss@3.0.43
@ephox/boss@3.0.44
@ephox/boss@3.0.45
@ephox/boss@3.0.46
@ephox/boss@3.0.47
@ephox/boss@3.0.48
@ephox/boulder@3.*
@ephox/boulder@3.3.26
@ephox/boulder@3.3.27
@ephox/boulder@3.3.28
@ephox/boulder@3.3.29
@ephox/boulder@3.3.31
@ephox/boulder@3.3.33
@ephox/boulder@3.3.34
@ephox/boulder@3.3.35
@ephox/boulder@3.3.36
@ephox/boulder@3.3.37
@ephox/boulder@3.3.38
@ephox/bridge@1.*
@ephox/bridge@1.0.74
@ephox/bridge@1.0.75
@ephox/bridge@1.0.76
@ephox/bridge@1.0.77
@ephox/bridge@1.0.78
@ephox/bridge@1.0.80
@ephox/bridge@1.0.81
@ephox/bridge@1.0.83
@ephox/bridge@1.0.84
@ephox/bridge@1.0.85
@ephox/bridge@1.0.86
@ephox/bridge@1.0.87
@ephox/bridge@1.0.88
@ephox/bridge@1.0.89
@ephox/darwin@3.*
@ephox/darwin@3.0.25
@ephox/darwin@3.0.26
@ephox/darwin@3.0.27
@ephox/darwin@3.0.28
@ephox/darwin@3.0.29
@ephox/darwin@3.0.30
@ephox/darwin@3.0.31
@ephox/darwin@3.0.32
@ephox/darwin@3.0.34
@ephox/darwin@3.0.36
@ephox/darwin@3.0.37
@ephox/darwin@3.0.38
@ephox/darwin@3.0.39
@ephox/darwin@4.*
@ephox/darwin@4.0.0
@ephox/darwin@4.0.1
@ephox/darwin@4.0.2
@ephox/darwin@4.0.3
@ephox/darwin@4.0.4
@ephox/darwin@4.0.5
@ephox/dragster@4.*
@ephox/dragster@4.0.22
@ephox/dragster@4.0.23
@ephox/dragster@4.0.24
@ephox/dragster@4.0.25
@ephox/dragster@4.0.26
@ephox/dragster@4.0.27
@ephox/dragster@4.0.28
@ephox/dragster@4.0.29
@ephox/dragster@4.0.31
@ephox/dragster@4.0.33
@ephox/dragster@4.0.34
@ephox/dragster@4.0.35
@ephox/dragster@4.0.36
@ephox/dragster@4.0.37
@ephox/dragster@4.0.38
@ephox/dragster@4.0.39
@ephox/dragster@4.0.40
@ephox/imagetools@3.*
@ephox/imagetools@3.2.5
@ephox/imagetools@3.2.6
@ephox/imagetools@3.2.7
@ephox/imagetools@3.2.8
@ephox/jax@4.*
@ephox/jax@4.1.17
@ephox/jax@4.1.18
@ephox/jax@4.1.19
@ephox/jax@4.1.20
@ephox/jax@4.1.22
@ephox/jax@4.1.24
@ephox/jax@4.1.25
@ephox/jax@4.1.26
@ephox/jax@4.1.27
@ephox/jax@4.1.28
@ephox/katamari@2.*
@ephox/katamari@2.4.28
@ephox/katamari@2.5.0
@ephox/katamari@2.5.1
@ephox/katamari@2.5.2
@ephox/katamari@3.*
@ephox/katamari@3.0.1
@ephox/katamari@4.*
@ephox/katamari@4.0.1
@ephox/katamari@4.0.2
@ephox/katamari@4.0.3
@ephox/katamari@4.0.4
@ephox/katamari@4.0.5
@ephox/mcagar@4.*
@ephox/mcagar@4.0.21
@ephox/mcagar@4.0.22
@ephox/mcagar@4.0.23
@ephox/mcagar@4.0.24
@ephox/mcagar@4.0.25
@ephox/mcagar@4.0.26
@ephox/mcagar@4.0.27
@ephox/mcagar@4.0.28
@ephox/mcagar@4.0.29
@ephox/mcagar@4.0.30
@ephox/mcagar@4.0.31
@ephox/mcagar@4.0.32
@ephox/mcagar@4.0.33
@ephox/mcagar@4.0.35
@ephox/mcagar@4.0.37
@ephox/mcagar@4.0.38
@ephox/mcagar@4.0.39
@ephox/mcagar@4.0.40
@ephox/mcagar@4.0.41
@ephox/mcagar@4.0.42
@ephox/mcagar@4.0.43
@ephox/mcagar@4.0.44
@ephox/mcagar@4.0.45
@ephox/mcagar@4.0.46
@ephox/mcagar@4.0.47
@ephox/mcagar@4.0.48
@ephox/phoenix@5.*
@ephox/phoenix@5.0.32
@ephox/phoenix@5.0.33
@ephox/phoenix@5.0.34
@ephox/phoenix@5.0.35
@ephox/phoenix@5.0.36
@ephox/phoenix@5.0.37
@ephox/phoenix@5.0.38
@ephox/phoenix@5.0.39
@ephox/phoenix@5.0.41
@ephox/phoenix@5.0.43
@ephox/phoenix@5.0.44
@ephox/phoenix@5.0.45
@ephox/phoenix@5.0.46
@ephox/phoenix@5.0.47
@ephox/phoenix@5.0.48
@ephox/phoenix@5.0.49
@ephox/phoenix@5.0.50
@ephox/polaris@3.*
@ephox/polaris@3.0.32
@ephox/polaris@3.0.33
@ephox/polaris@3.0.34
@ephox/polaris@3.0.35
@ephox/polaris@3.0.37
@ephox/polaris@3.0.39
@ephox/polaris@3.0.40
@ephox/polaris@3.0.41
@ephox/polaris@3.0.42
@ephox/polaris@3.0.43
@ephox/porkbun@4.*
@ephox/porkbun@4.0.19
@ephox/porkbun@4.0.20
@ephox/porkbun@4.0.21
@ephox/porkbun@4.0.22
@ephox/porkbun@4.0.24
@ephox/porkbun@4.0.26
@ephox/porkbun@4.0.27
@ephox/porkbun@4.0.28
@ephox/porkbun@4.0.29
@ephox/porkbun@4.0.30
@ephox/robin@7.*
@ephox/robin@7.0.26
@ephox/robin@7.0.27
@ephox/robin@7.0.28
@ephox/robin@7.0.29
@ephox/robin@7.0.30
@ephox/robin@7.0.31
@ephox/robin@7.0.32
@ephox/robin@7.0.33
@ephox/robin@7.0.35
@ephox/robin@7.0.37
@ephox/robin@7.0.38
@ephox/robin@7.0.39
@ephox/robin@7.0.40
@ephox/robin@7.0.41
@ephox/robin@7.0.42
@ephox/robin@7.0.43
@ephox/robin@7.0.44
@ephox/sand@3.*
@ephox/sand@3.0.10
@ephox/sand@3.0.11
@ephox/sand@3.0.12
@ephox/sand@3.0.3
@ephox/sand@3.0.4
@ephox/sand@3.0.5
@ephox/sand@3.0.6
@ephox/sand@3.0.8
@ephox/sand@3.1.0
@ephox/sand@3.1.1
@ephox/sand@3.1.2
@ephox/snooker@5.*
@ephox/snooker@5.0.10
@ephox/snooker@5.0.12
@ephox/snooker@5.0.14
@ephox/snooker@5.0.15
@ephox/snooker@5.0.16
@ephox/snooker@5.0.17
@ephox/snooker@5.0.3
@ephox/snooker@5.0.4
@ephox/snooker@5.0.5
@ephox/snooker@5.0.6
@ephox/snooker@5.0.7
@ephox/snooker@5.0.8
@ephox/snooker@5.0.9
@ephox/snooker@5.1.0
@ephox/snooker@5.1.1
@ephox/snooker@5.1.2
@ephox/snooker@5.1.3
@ephox/sugar@5.*
@ephox/sugar@5.0.0
@ephox/sugar@5.0.1
@ephox/sugar@5.0.11
@ephox/sugar@5.0.12
@ephox/sugar@5.0.13
@ephox/sugar@5.0.14
@ephox/sugar@5.0.15
@ephox/sugar@5.0.16
@ephox/sugar@5.0.17
@ephox/sugar@5.0.18
@ephox/sugar@5.0.2
@ephox/sugar@5.0.3
@ephox/sugar@5.0.4
@ephox/sugar@5.0.5
@ephox/sugar@5.0.6
@ephox/sugar@5.0.7
@ephox/sugar@5.0.9
@tinymce/oxide-icons-default@1.*
@tinymce/oxide-icons-default@1.1.0
@tinymce/oxide-icons-default@1.1.1
@tinymce/oxide@1.*
@tinymce/oxide@1.0.233
@tinymce/oxide@1.0.234
@tinymce/oxide@1.0.235
@tinymce/oxide@1.0.236
@tinymce/oxide@1.0.237
@tinymce/oxide@1.0.238
@tinymce/oxide@1.1.0
@tinymce/oxide@1.1.1
@tinymce/oxide@1.1.2
@tinymce/oxide@1.1.3
@tinymce/oxide@1.1.4
@tinymce/oxide@1.1.5
@tinymce/oxide@1.1.6
@tinymce/oxide@1.1.7

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-17480.json"