CVE-2024-29203

Опубликовано: 26 мар. 2024

Источник: nvd

CVSS3: 4.3

CVSS3: 6.1

EPSS Низкий

Описание

TinyMCE is an open source rich text editor. A cross-site scripting (XSS) vulnerability was discovered in TinyMCE’s content insertion code. This allowed iframe elements containing malicious code to execute when inserted into the editor. These iframe elements are restricted in their permissions by same-origin browser protections, but could still trigger operations such as downloading of malicious assets. This vulnerability is fixed in 6.8.1.

Ссылки

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:tiny:tinymce:*:*:*:*:*:*:*:*

Версия до 6.8.1 (исключая)

cpe:2.3:a:tiny:tinymce:*:*:*:*:*:*:*:*

Версия от 6.8.2 (включая) до 7.0.0 (исключая)

EPSS

Процентиль: 79%

0.01231

Низкий

4.3 Medium

CVSS3

6.1 Medium

CVSS3

Дефекты

CWE-79

Связанные уязвимости

CVE-2024-29203

CVSS3: 4.3

ubuntu

почти 2 года назад

TinyMCE is an open source rich text editor. A cross-site scripting (XSS) vulnerability was discovered in TinyMCE’s content insertion code. This allowed `iframe` elements containing malicious code to execute when inserted into the editor. These `iframe` elements are restricted in their permissions by same-origin browser protections, but could still trigger operations such as downloading of malicious assets. This vulnerability is fixed in 6.8.1.

CVE-2024-29203

CVSS3: 4.3

debian

почти 2 года назад

TinyMCE is an open source rich text editor. Across-site scripting (XSS ...

GHSA-438c-3975-5x3f

CVSS3: 4.3

github

почти 2 года назад

TinyMCE Cross-Site Scripting (XSS) vulnerability in handling iframes

EPSS

Процентиль: 79%

0.01231

Низкий

4.3 Medium

CVSS3

6.1 Medium

CVSS3

Дефекты

CWE-79