Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
osvGoogleOSV:GHSA-VJWG-28GV-PM8H
HistoryApr 24, 2024 - 5:02 p.m.

Pimcore TinyMCE Bundle - tinymce CVE-2024-29203, CVE-2024-29881

2024-04-2417:02:33
Google
osv.dev
48
pimcore
tinymce
bundle
cve-2024-29203
cve-2024-29881
upgrade
xss
vulnerability
security
software

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

AI Score

4.2

Confidence

High

EPSS

0

Percentile

15.5%

JSON

Impact

The TineMCE Bundle uses tinymce version 6.7.3. CVEs for this version exists for <6.8.1:
https://nvd.nist.gov/vuln/detail/CVE-2024-29203
https://nvd.nist.gov/vuln/detail/CVE-2024-29881

Patches

The package should be updated to at least 6.8.1 to avoid XSS vulnerability.

Workarounds

Upgrade pimcore to release 11.2.3 or 11.1.6.5.

References

https://nvd.nist.gov/vuln/detail/CVE-2024-29203
https://nvd.nist.gov/vuln/detail/CVE-2024-29881

Related

github 3
ibm 3
veracode 2
cve 2
osv 4
nvd 2
cvelist 2
vulnrichment 2
debiancve 2
oracle 1
github
github
Pimcore TinyMCE Bundle - tinymce CVE-2024-29203, CVE-2024-29881
2024-04-24 17:02:33
TinyMCE Cross-Site Scripting (XSS) vulnerability in handling external SVG files through Object or Embed elements
2024-03-26 21:23:45
TinyMCE Cross-Site Scripting (XSS) vulnerability in handling iframes
2024-03-26 21:23:47
ibm
ibm
Security Bulletin: IBM Maximo Application Suite uses tinymce-5.10.9.tgz which is vulnerable to CVE-2024-29203, CVE-2024-29881, and CVE-2024-29203.
2024-07-15 07:26:37
Security Bulletin: Maximo Asset Management - There is a vulnerability in tinymce-6.7.3.min.js used by IBM Maximo Asset Management application (CVE-2024-29881)
2024-06-12 15:54:53
Security Bulletin: IBM Maximo Asset Management - There is a vulnerability in tinymce-6.7.3.min.js used by IBM Maximo Asset Management application (CVE-2024-29203)
2024-06-12 15:55:11
veracode
veracode
Cross-Site Scripting (XSS)
2024-04-01 05:43:53
Cross-Site Scripting (XSS)
2024-04-01 05:40:45
cve
cve
CVE-2024-29881
2024-03-26 14:15:09
CVE-2024-29203
2024-03-26 14:15:08
osv
osv
CVE-2024-29881
2024-03-26 14:15:09
TinyMCE Cross-Site Scripting (XSS) vulnerability in handling iframes
2024-03-26 21:23:47
CVE-2024-29203
2024-03-26 14:15:08
nvd
nvd
CVE-2024-29881
2024-03-26 14:15:09
CVE-2024-29203
2024-03-26 14:15:08
cvelist
cvelist
CVE-2024-29881 TinyMCE Cross-Site Scripting (XSS) vulnerability in handling external SVG files through Object or Embed elements
2024-03-26 13:31:15
CVE-2024-29203 TinyMCE Cross-Site Scripting (XSS) vulnerability in handling iframes
2024-03-26 13:23:53
vulnrichment
vulnrichment
CVE-2024-29881 TinyMCE Cross-Site Scripting (XSS) vulnerability in handling external SVG files through Object or Embed elements
2024-03-26 13:31:15
CVE-2024-29203 TinyMCE Cross-Site Scripting (XSS) vulnerability in handling iframes
2024-03-26 13:23:53
debiancve
debiancve
CVE-2024-29203
2024-03-26 14:15:08
CVE-2024-29881
2024-03-26 14:15:09
oracle
oracle
Oracle Critical Patch Update Advisory - July 2024
2024-07-16 00:00:00

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

AI Score

4.2

Confidence

High

EPSS

0

Percentile

15.5%

JSON
Related for OSV:GHSA-VJWG-28GV-PM8H
github3ibm3veracode2cve2osv4nvd2cvelist2vulnrichment2debiancve2oracle1