p PatchFirst

CVE-2019-1010091

CVE-2019-1010091

This page contains facts from public vulnerability sources. Check the original advisory before updating.

tinymce 4.7.11, 4.7.12 is affected by: CWE-79: Improper Neutralization of Input During Web Page Generation. The impact is: JavaScript code execution. The component is: Media element. The attack vector is: The victim must paste malicious content to media element's embed tab.

CVSS 6.1 · Medium · EPSS 1.9% · Fix available

Published
Updated

Stack: system · node

Affected products and versions

  • tinymce

    Versions
    • 4.7.11, 4.7.12: Affected

    No fix published

  • tinymce npm

    Affected ranges
    • SEMVER: < 4.9.10

    Update to 4.9.10

  • tinymce npm

    Affected ranges
    • SEMVER: ≥ 5.0.0, < 5.2.2

    Update to 5.2.2

  • tinymce Ubuntu:16.04:LTS

    Versions
    • 3.4.8+dfsg0-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • tinymce Ubuntu:18.04:LTS

    Versions
    • 3.4.8+dfsg0-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • tinymce Ubuntu:20.04:LTS

    Versions
    • 3.4.8+dfsg0-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →