p PatchFirst

GHSA-jxcx-3h54-qqxx

GHSA-jxcx-3h54-qqxx · SilverStripe CMS Cross-site Scripting vulnerabilities inherited from TinyMCE

This page contains facts from public vulnerability sources. Check the original advisory before updating.

TinyMCE 4.x is vulnerable to several XSS vectors, which had been patched in later versions. Two of these have been identified as affecting silverstripe/admin. Only Silverstripe CMS 4 is affected by these vulnerabilities. It's not possible to upgrade Silverstripe CMS 4 to use a more recent release of TinyMCE without introducing breaking changes. Instead, the security patches that shipped in later releases of TinyMCE have been backported to the TinyMCE version bundled in silverstripe/admin. Silverstripe CMS 5 is not affected by these vulnerabilities because it uses TinyMCE 6.

Fix available

Published
Updated

Stack: php

Affected products and versions

  • silverstripe/admin Packagist

    Versions
    • 1.0.0
    • 1.0.1
    • 1.0.1-rc1
    • 1.0.2
    • 1.0.3
    • 1.0.4
    • 1.0.5
    • 1.0.6
    • 1.0.7
    • 1.1.0
    • 1.1.0-rc1
    • 1.1.0-rc2
    • 1.1.1
    • 1.1.2
    • 1.1.3
    • 1.1.4
    • 1.1.5
    • 1.10.0
    • 1.10.0-beta1
    • 1.10.0-rc1
    • 1.10.1
    • 1.10.2
    • 1.10.3
    • 1.10.4
    • 1.11.0
    • 1.11.0-beta1
    • 1.11.0-rc1
    • 1.11.1
    • 1.11.2
    • 1.11.3
    • 1.12.0
    • 1.12.0-beta1
    • 1.12.0-rc1
    • 1.12.1
    • 1.12.2
    • 1.12.3
    • 1.12.4
    • 1.12.5
    • 1.12.6
    • 1.12.7
    • 1.13.0
    • 1.13.0-beta1
    • 1.13.0-rc1
    • 1.13.1
    • 1.13.2
    • 1.13.3
    • 1.13.4
    • 1.13.5
    • 1.2.0
    • 1.2.0-beta1
    • 1.2.1
    • 1.2.2
    • 1.2.3
    • 1.2.4
    • 1.2.5
    • 1.2.6
    • 1.3.0
    • 1.3.0-rc1
    • 1.3.1
    • 1.3.2
    • 1.3.3
    • 1.3.4
    • 1.3.5
    • 1.4.0
    • 1.4.0-rc1
    • 1.4.1
    • 1.4.2
    • 1.4.3
    • 1.4.4
    • 1.4.5
    • 1.5.0
    • 1.5.0-alpha1
    • 1.5.0-rc1
    • 1.5.0-rc2
    • 1.5.1
    • 1.5.2
    • 1.6.0
    • 1.6.0-beta1
    • 1.6.0-rc1
    • 1.6.1
    • 1.6.2
    • 1.6.3
    • 1.6.4
    • 1.7.0
    • 1.7.0-beta1
    • 1.7.0-rc1
    • 1.7.1
    • 1.7.2
    • 1.7.3
    • 1.7.4
    • 1.8.0
    • 1.8.0-beta1
    • 1.8.0-rc1
    • 1.8.1
    • 1.9.0
    • 1.9.0-alpha1
    • 1.9.0-beta1
    • 1.9.0-rc1
    Affected ranges
    • ECOSYSTEM: ≥ 1.0.0, < 1.13.6

    Update to 1.13.6

Original sources

Check your server →