CVE-2024-29203

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-29203
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-29203.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-29203
Aliases
Downstream
Published
2024-03-26T13:23:53.673Z
Modified
2026-03-14T12:33:49.489286Z
Severity
  • 4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N CVSS Calculator
Summary
TinyMCE Cross-Site Scripting (XSS) vulnerability in handling iframes
Details

TinyMCE is an open source rich text editor. A cross-site scripting (XSS) vulnerability was discovered in TinyMCE’s content insertion code. This allowed iframe elements containing malicious code to execute when inserted into the editor. These iframe elements are restricted in their permissions by same-origin browser protections, but could still trigger operations such as downloading of malicious assets. This vulnerability is fixed in 6.8.1.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-79"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/29xxx/CVE-2024-29203.json"
}
References

Affected packages

Git / github.com/tinymce/tinymce

Affected ranges

Type
GIT
Repo
https://github.com/tinymce/tinymce
Events
Introduced
cc69eff2819659a199261bbdfacdbb08ae083923
Fixed
376b40a04ce9b41bf499f6c82ef1a0daa7bc6201

Affected versions

6.*
6.8.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-29203.json"