Publish GHSA-vrv8-v4w8-f95h

advisories/github-reviewed/2020/08/GHSA-vrv8-v4w8-f95h/GHSA-vrv8-v4w8-f95h.json

@@ -1,15 +1,18 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-vrv8-v4w8-f95h",
-  "modified": "2020-08-11T16:24:30Z",
+  "modified": "2023-05-22T14:51:38Z",
   "published": "2020-08-11T14:55:01Z",
   "aliases": [
-
+    "CVE-2020-12648"
   ],
   "summary": "Cross-site scripting vulnerability in TinyMCE",
   "details": "### Impact\nA cross-site scripting (XSS) vulnerability was discovered in the core parser. The vulnerability allowed arbitrary JavaScript execution when inserting a specially crafted piece of content into the editor via the clipboard or APIs. This impacts all users who are using TinyMCE 4.9.10 or lower and TinyMCE 5.4.0 or lower.\n\n### Patches\nThis vulnerability has been patched in TinyMCE 4.9.11 and 5.4.1 by improved HTML parsing and sanitization logic.\n\n### Workarounds\nThe workarounds available are:\n- upgrade to either TinyMCE 4.9.11 or TinyMCE 5.4.1\nor\n- enable the media plugin, which overrides the default parsing behaviour for iframes\nor\n- add the following workaround to update the parsing schema rules for iframes:\n\n#### Example: Change the default schema for iframes\n```js\nsetup: function(editor) {\n  editor.on('PreInit', function() {\n    editor.schema.getSpecialElements()['iframe'] = /</iframe[^>]*>/gi;\n  });\n}\n```\n\n### Acknowledgements\nTiny Technologies would like to thank George Steketee and Chris Davis at [Bishop Fox](https://www.bishopfox.com/) for discovering this vulnerability.\n\n### References\nhttps://www.tiny.cloud/docs/release-notes/release-notes54/#securityfixes\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in the [TinyMCE repo](https://github.com/tinymce/tinymce/issues)\n* Email us at [infosec@tiny.cloud](mailto:infosec@tiny.cloud)",
   "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
+    }
   ],
   "affected": [
     {
@@ -55,6 +58,26 @@
     {
       "type": "WEB",
       "url": "https://github.com/tinymce/tinymce/security/advisories/GHSA-vrv8-v4w8-f95h"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/tinymce/tinymce/pull/5843"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/tinymce/tinymce/commit/2b71c922214d388838d930806207a66c14e80f63"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/tinymce/tinymce/commit/696e43658dc9750ec24fdc4650bd2be9653daf5b"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/tinymce/tinymce"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.tiny.cloud/docs/release-notes/release-notes54/#securityfixes"
     }
   ],
   "database_specific": {