CVE-2024-29203 MEDIUM

CVE-2024-29203: TinyMCE Cross-Site Scripting (XSS) vulnerability in handling iframes

Vendor Tinymce
Product tinymce
Weakness CWE-79 · XSS
Published March 26, 2024
Last update August 6, 2024
View on NVD All CVEs

CVSS base score

4.3/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction Required
Confidentiality Low
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

What the vulnerability does

01Description

TinyMCE is an open source rich text editor. A cross-site scripting (XSS) vulnerability was discovered in TinyMCE’s content insertion code. This allowed `iframe` elements containing malicious code to execute when inserted into the editor. These `iframe` elements are restricted in their permissions by same-origin browser protections, but could still trigger operations such as downloading of malicious assets. This vulnerability is fixed in 6.8.1.

Key dates

02Disclosure timeline

March 26, 2024 CVE published
August 6, 2024 Record updated