GHSA-vjwg-28gv-pm8h

Source

https://github.com/advisories/GHSA-vjwg-28gv-pm8h

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/04/GHSA-vjwg-28gv-pm8h/GHSA-vjwg-28gv-pm8h.json

Published

2024-04-24T17:02:33Z

Modified

2024-04-24T17:17:45.358469Z

Details

Impact

The TineMCE Bundle uses tinymce version 6.7.3. CVEs for this version exists for <6.8.1: https://nvd.nist.gov/vuln/detail/CVE-2024-29203 https://nvd.nist.gov/vuln/detail/CVE-2024-29881

Patches

The package should be updated to at least 6.8.1 to avoid XSS vulnerability.

Workarounds

Upgrade pimcore to release 11.2.3.

References

https://nvd.nist.gov/vuln/detail/CVE-2024-29203 https://nvd.nist.gov/vuln/detail/CVE-2024-29881

References

• https://github.com/pimcore/pimcore/security/advisories/GHSA-vjwg-28gv-pm8h
• https://github.com/pimcore/pimcore