CVE-2012-4230: XSS

Published Apr 25, 2014

Updated

The bbcode plugin in TinyMCE 3.5.8 does not properly enforce the TinyMCE security policy for the (1) encoding directive and (2) validelements attribute, which allows attackers to conduct cross-site scripting (XSS) attacks via application-specific vectors, as demonstrated using a textarea element.

Affected Software

1 affected component

TinyMCE TinyMCE=3.5.8

Event History

Apr 25, 2014

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

Description

Data Sourced

via NVD·02:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2012-4230?

CVE-2012-4230 is classified as a medium severity vulnerability due to its potential for enabling cross-site scripting (XSS) attacks.

How do I fix CVE-2012-4230?

To mitigate CVE-2012-4230, upgrade TinyMCE to version 3.5.9 or later, which addresses the security issues.

What types of attacks are possible with CVE-2012-4230?

CVE-2012-4230 allows attackers to perform cross-site scripting (XSS) attacks exploiting improper handling of bbcode in TinyMCE.

Which versions of TinyMCE are affected by CVE-2012-4230?

CVE-2012-4230 affects TinyMCE version 3.5.8 specifically.

What is the main cause of CVE-2012-4230?

CVE-2012-4230 is caused by inadequate enforcement of the TinyMCE security policy regarding encoding directives and valid_elements.