CVE-2020-23066: XSS
Published Jun 26, 2023
·Updated
Cross Site Scripting vulnerability in TinyMCE v.4.9.6 and before and v.5.0.0 thru v.5.1.4 allows an attacker to execute arbitrary code via the editor function.
Other sources
Rejected reason: DO NOT USE THIS CVE ID NUMBER. Consult IDs: CVE-2020-17480. Reason: This CVE Record is a duplicate of CVE-2020-17480. Notes: All CVE users should reference CVE-2020-17480 instead of this record.
— NVD
Affected Software
2 affected components
Tiny TinyMCE<=4.9.6
Tiny TinyMCE>=5.0.0<=5.1.4
Event History
Jun 26, 2023
CVE Published
via MITRE·12:00 AM
Rejected
via MITRE·12:00 AM
Data Sourced
via NVD·07:15 PM
Description
May 14, 2024
Rejected
via MITRE·08:34 PM
Frequently Asked Questions
1
What is the vulnerability ID?
The vulnerability ID is CVE-2020-23066.
2
What is the severity of CVE-2020-23066?
The severity of CVE-2020-23066 is medium (CVSS score: 6.1).
3
What is the affected software?
The affected software is TinyMCE versions 4.9.6 and earlier, and versions 5.0.0 through 5.1.4.
4
How can an attacker exploit CVE-2020-23066?
An attacker can exploit CVE-2020-23066 by executing arbitrary code via the editor function.
5
How can I fix CVE-2020-23066?
To fix CVE-2020-23066, update TinyMCE to version 5.1.5 or higher.