GHSA-gg8r-xjwq-4w92

Suggest an improvement
Source
https://github.com/advisories/GHSA-gg8r-xjwq-4w92
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/12/GHSA-gg8r-xjwq-4w92/GHSA-gg8r-xjwq-4w92.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-gg8r-xjwq-4w92
Aliases
Published
2022-12-08T23:30:01Z
Modified
2023-11-08T04:08:19Z
Severity
  • 5.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
Summary
Cross-site scripting vulnerability in TinyMCE alerts
Details

Impact

A cross-site scripting (XSS) vulnerability was discovered in the alert and confirm dialogs when these dialogs were provided with malicious HTML content. This can occur in plugins that use the alert or confirm dialogs, such as in the image plugin, which presents these dialogs when certain errors occur. The vulnerability allowed arbitrary JavaScript execution when an alert presented in the TinyMCE UI for the current user.

Patches

This vulnerability has been patched in TinyMCE 5.10.7 and TinyMCE 6.3.1 by ensuring HTML sanitization was still performed after unwrapping invalid elements.

Fix

To avoid this vulnerability:

  • Upgrade to TinyMCE 5.10.7 or higher for TinyMCE 5.x.
  • Upgrade to TinyMCE 6.3.1 or higher for TinyMCE 6.x.

Workaround

To reduce the impact of this vulnerability:

  • Ensure the the images_upload_handler returns a valid value as per the images_upload_handler documentation.

References

For more information

If you have any questions or comments about this advisory:

Database specific 
{
    "cwe_ids":  [
        "CWE-79"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2022-12-08T23:30:01Z",
    "nvd_published_at":  "2022-12-08T22:15:00Z",
    "severity":  "MODERATE"
}
References

Affected packages

npm
tinymce

Package

Name
tinymce
View open source insights on deps.dev
Purl
pkg:npm/tinymce

Affected ranges

Type
SEMVER
Events
Introduced
6.0.0
Fixed
6.3.1

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/12/GHSA-gg8r-xjwq-4w92/GHSA-gg8r-xjwq-4w92.json"
tinymce

Package

Name
tinymce
View open source insights on deps.dev
Purl
pkg:npm/tinymce

Affected ranges

Type
SEMVER
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
5.10.7

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/12/GHSA-gg8r-xjwq-4w92/GHSA-gg8r-xjwq-4w92.json"
NuGet
TinyMCE

Package

Name
TinyMCE
View open source insights on deps.dev
Purl
pkg:nuget/TinyMCE

Affected ranges

Type
ECOSYSTEM
Events
Introduced
6.0.0
Fixed
6.3.1

Affected versions

6.*
6.0.0
6.0.1
6.0.2
6.0.3
6.1.0
6.1.1
6.1.2
6.2.0
6.3.0

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/12/GHSA-gg8r-xjwq-4w92/GHSA-gg8r-xjwq-4w92.json"
TinyMCE

Package

Name
TinyMCE
View open source insights on deps.dev
Purl
pkg:nuget/TinyMCE

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
5.10.7

Affected versions

3.*
3.4.3.2
3.4.4
3.4.5
3.4.7
3.5.0
3.5.0.1
3.5.1
3.5.1.1
3.5.2
3.5.3
3.5.4
3.5.4.1
3.5.5
3.5.6
3.5.7
3.5.8
4.*
4.0.0
4.0.1
4.0.2
4.0.4
4.0.5
4.0.6
4.0.8
4.0.9
4.0.10
4.0.11
4.0.13
4.0.14
4.0.15
4.0.16
4.0.17
4.0.18
4.0.19
4.0.20
4.0.21
4.0.22
4.0.23
4.0.24
4.0.25
4.0.26
4.0.27
4.0.28
4.1.0
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1.10
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
4.2.7
4.2.8
4.3.0
4.3.1
4.3.2
4.3.3
4.3.4
4.3.6
4.3.7
4.3.8
4.3.9
4.3.10
4.3.11
4.3.12
4.3.13
4.4.0
4.4.1
4.4.2
4.4.3
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.6.0
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.7.0
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.7.8
4.7.9
4.7.10
4.7.11
4.7.12
4.7.13
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.9.0
4.9.1
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
4.9.10
4.9.11
5.*
5.0.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.2
5.4.0
5.4.1
5.4.2
5.5.0
5.5.1
5.6.0
5.6.1
5.6.2
5.7.0
5.7.1
5.8.0
5.8.1
5.8.2
5.9.0
5.9.1
5.9.2
5.10.0
5.10.1
5.10.2
5.10.3
5.10.4
5.10.5
5.10.6

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/12/GHSA-gg8r-xjwq-4w92/GHSA-gg8r-xjwq-4w92.json"
Packagist
tinymce/tinymce

Package

Name
tinymce/tinymce
Purl
pkg:composer/tinymce/tinymce

Affected ranges

Type
ECOSYSTEM
Events
Introduced
6.0.0
Fixed
6.3.1

Affected versions

6.*
6.0.0
6.0.1
6.0.2
6.0.3
6.1.0
6.1.1
6.1.2
6.2.0
6.3.0

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/12/GHSA-gg8r-xjwq-4w92/GHSA-gg8r-xjwq-4w92.json"
tinymce/tinymce

Package

Name
tinymce/tinymce
Purl
pkg:composer/tinymce/tinymce

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
5.10.7

Affected versions

4.*
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6
4.0.7
4.0.8
4.0.9
4.0.10
4.0.11
4.0.12
4.0.13
4.0.14
4.0.15
4.0.16
4.0.17
4.0.18
4.0.19
4.0.20
4.0.21
4.0.22
4.0.23
4.0.24
4.0.25
4.0.26
4.0.27
4.0.28
4.1.0
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1.10
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
4.2.7
4.2.8
4.3.0
4.3.1
4.3.2
4.3.3
4.3.4
4.3.6
4.3.7
4.3.8
4.3.9
4.3.10
4.3.11
4.3.12
4.3.13
4.4.0
4.4.1
4.4.2
4.4.3
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.5.12
4.6.0
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.7.0
4.7.1
4.7.2
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.7.8
4.7.9
4.7.10
4.7.11
4.7.12
4.7.13
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.9.0
4.9.1
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
4.9.10
4.9.11
5.*
5.0.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.2
5.4.0
5.4.1
5.4.2
5.5.0
5.5.1
5.6.0
5.6.1
5.6.2
5.7.0
5.7.1
5.8.0
5.8.1
5.8.2
5.9.0
5.9.1
5.9.2
5.10.0
5.10.1
5.10.2
5.10.3
5.10.4
5.10.5
5.10.6

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/12/GHSA-gg8r-xjwq-4w92/GHSA-gg8r-xjwq-4w92.json"