PT-2020-15020

CVE-2020-17480

Published

2020-01-30

Updated

2021-05-06

Description by

CVSS 3.1

6.1

Medium

MetricsAV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions TinyMCE versions 4.9.6 and earlier TinyMCE versions 5.1.3 and earlier

Description A cross-site scripting (XSS) issue was discovered in the core parser, paste and visualchars plugins, allowing arbitrary JavaScript execution when inserting specially crafted content into the editor via the clipboard or APIs.

Recommendations For TinyMCE versions 4.9.6 and earlier, upgrade to TinyMCE 4.9.7. For TinyMCE versions 5.1.3 and earlier, upgrade to TinyMCE 5.1.4. As a temporary workaround, consider disabling the impacted plugins. Manually sanitize the content using the BeforeSetContent event.

Exploitability

Exploit

Fix

Impacts

Researchers

Vendors

Affected products

Weakness enumeration

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')

Related identifiers

CVE-2020-17480

GHSA-27GM-GHR9-4V95