diff --git a/advisories/github-reviewed/2020/08/GHSA-vrv8-v4w8-f95h/GHSA-vrv8-v4w8-f95h.json b/advisories/github-reviewed/2020/08/GHSA-vrv8-v4w8-f95h/GHSA-vrv8-v4w8-f95h.json index 452d7b5ef90..8b1de03c9de 100644 --- a/advisories/github-reviewed/2020/08/GHSA-vrv8-v4w8-f95h/GHSA-vrv8-v4w8-f95h.json +++ b/advisories/github-reviewed/2020/08/GHSA-vrv8-v4w8-f95h/GHSA-vrv8-v4w8-f95h.json @@ -1,15 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-vrv8-v4w8-f95h", - "modified": "2020-08-11T16:24:30Z", + "modified": "2023-05-22T14:51:38Z", "published": "2020-08-11T14:55:01Z", "aliases": [ - + "CVE-2020-12648" ], "summary": "Cross-site scripting vulnerability in TinyMCE", "details": "### Impact\nA cross-site scripting (XSS) vulnerability was discovered in the core parser. The vulnerability allowed arbitrary JavaScript execution when inserting a specially crafted piece of content into the editor via the clipboard or APIs. This impacts all users who are using TinyMCE 4.9.10 or lower and TinyMCE 5.4.0 or lower.\n\n### Patches\nThis vulnerability has been patched in TinyMCE 4.9.11 and 5.4.1 by improved HTML parsing and sanitization logic.\n\n### Workarounds\nThe workarounds available are:\n- upgrade to either TinyMCE 4.9.11 or TinyMCE 5.4.1\nor\n- enable the media plugin, which overrides the default parsing behaviour for iframes\nor\n- add the following workaround to update the parsing schema rules for iframes:\n\n#### Example: Change the default schema for iframes\n```js\nsetup: function(editor) {\n editor.on('PreInit', function() {\n editor.schema.getSpecialElements()['iframe'] = /]*>/gi;\n });\n}\n```\n\n### Acknowledgements\nTiny Technologies would like to thank George Steketee and Chris Davis at [Bishop Fox](https://www.bishopfox.com/) for discovering this vulnerability.\n\n### References\nhttps://www.tiny.cloud/docs/release-notes/release-notes54/#securityfixes\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in the [TinyMCE repo](https://github.com/tinymce/tinymce/issues)\n* Email us at [infosec@tiny.cloud](mailto:infosec@tiny.cloud)", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" + } ], "affected": [ { @@ -55,6 +58,26 @@ { "type": "WEB", "url": "https://github.com/tinymce/tinymce/security/advisories/GHSA-vrv8-v4w8-f95h" + }, + { + "type": "WEB", + "url": "https://github.com/tinymce/tinymce/pull/5843" + }, + { + "type": "WEB", + "url": "https://github.com/tinymce/tinymce/commit/2b71c922214d388838d930806207a66c14e80f63" + }, + { + "type": "WEB", + "url": "https://github.com/tinymce/tinymce/commit/696e43658dc9750ec24fdc4650bd2be9653daf5b" + }, + { + "type": "PACKAGE", + "url": "https://github.com/tinymce/tinymce" + }, + { + "type": "WEB", + "url": "https://www.tiny.cloud/docs/release-notes/release-notes54/#securityfixes" } ], "database_specific": {