CVE-2024-21908CWE-79

Cross-site scripting vulnerability in TinyMCE

Medium · published January 3, 2024

CVSS v3.1
6.1
EPSS
1%
Percentile
64.5
In the wild
Unconfirmed
What it is

TinyMCE versions before 5.9.0 are affected by a stored cross-site scripting vulnerability. An unauthenticated and remote attacker could insert crafted HTML into the editor resulting in arbitrary JavaScript execution in another user's browser.

The record
Technical detail
CVSS v3.1
6.1 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.01066 · 64.5th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2024-01-03T15:38Z
EPSS history
Timeline
  • 03 JAN 15:38Z
    Cross-site scripting vulnerability in TinyMCE
    cvelistv5