Описание
TinyMCE is an open source rich text editor. Prior to 5.11.1, 7.9.3, and 8.5.1, there is a stored XSS vulnerability via unsanitized data-mce-* attributes (data-mce-href, data-mce-src, data-mce-style). Allows attackers to inject malicious values that override safe attributes during serialization, bypassing validation. This vulnerability is fixed in 5.11.1, 7.9.3, and 8.5.1.
Ссылки
- PatchVendor Advisory
- Release Notes
- Release Notes
Уязвимые конфигурации
Одно из
EPSS
8.7 High
CVSS3
5.4 Medium
CVSS3
Дефекты
Связанные уязвимости
TinyMCE is an open source rich text editor. Prior to 5.11.1, 7.9.3, and 8.5.1, there is a stored XSS vulnerability via unsanitized data-mce-* attributes (data-mce-href, data-mce-src, data-mce-style). Allows attackers to inject malicious values that override safe attributes during serialization, bypassing validation. This vulnerability is fixed in 5.11.1, 7.9.3, and 8.5.1.
TinyMCE is an open source rich text editor. Prior to 5.11.1, 7.9.3, an ...
TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes
EPSS
8.7 High
CVSS3
5.4 Medium
CVSS3