GHSA-vjwg-28gv-pm8h Pimcore TinyMCE Bundle - tinymce CVE-2024-29203, CVE-2024-29881
An XSS vulnerability in the TinyMCE editor allows attackers to execute arbitrary scripts, potentially leading to session hijacking or data theft.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is GHSA-vjwg-28gv-pm8h?
GHSA-vjwg-28gv-pm8h is a cross-site scripting vulnerability in pimcore/pimcore, published on 24 Apr 2024. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Impact
The TineMCE Bundle uses tinymce version 6.7.3. CVEs for this version exists for <6.8.1: https://nvd.nist.gov/vuln/detail/CVE-2024-29203 https://nvd.nist.gov/vuln/detail/CVE-2024-29881
Patches
The package should be updated to at least 6.8.1 to avoid XSS vulnerability.
Workarounds
Upgrade pimcore to release 11.2.3 or 11.1.6.5.
References
https://nvd.nist.gov/vuln/detail/CVE-2024-29203 https://nvd.nist.gov/vuln/detail/CVE-2024-29881
Which versions are affected by GHSA-vjwg-28gv-pm8h?
4 open source packages ship an affected version, including pimcore/pimcore.
| Package | Affected | Fixed in |
|---|---|---|
pimcore/pimcore Packagist | From 11.0.0-ALPHA1 | 11.1.6.5 |
pimcore/pimcore Packagist | From 11.0.0-ALPHA1 | 11.1.6.5 |
pimcore/pimcore Packagist | From 11.2.0 | 11.2.3 |
pimcore/pimcore Packagist | From 11.2.0 | 11.2.3 |
How do I fix GHSA-vjwg-28gv-pm8h?
Upgrade pimcore/pimcore to a fixed version for your release line: 11.1.6.5 or 11.2.3.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is GHSA-vjwg-28gv-pm8h being exploited?
There is no known exploitation of GHSA-vjwg-28gv-pm8h in the wild and no public exploit code.