CVE-2024-21910: Cross-site scripting vulnerability in TinyMCE plugins
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-5h9g-x5rv-25wg. This link is maintained to preserve external references.
Original Description TinyMCE versions before 5.10.0 are affected by a cross-site scripting vulnerability. A remote and unauthenticated attacker could introduce crafted image or link URLs that would result in the execution of arbitrary JavaScript in an editing user's browser.
Other sources
Impact A cross-site scripting (XSS) vulnerability was discovered in the URL processing logic of the image and link plugins. The vulnerability allowed arbitrary JavaScript execution when updating an image or link using a specially crafted URL. This issue only impacted users while editing and the dangerous URLs were stripped in any content extracted from the editor. This impacts all users who are using TinyMCE 5.9.2 or lower.
Patches This vulnerability has been patched in TinyMCE 5.10.0 by improved sanitization logic when updating URLs in the relevant plugins.
Workarounds To work around this vulnerability, either: - Upgrade to TinyMCE 5.10.0 or higher - Disable the image and link plugins
Acknowledgements Tiny Technologies would like to thank Yakir6 for discovering this vulnerability.
References https://www.tiny.cloud/docs/release-notes/release-notes510/#securityfixes
For more information If you have any questions or comments about this advisory: Email us at infosec@tiny.cloud Open an issue in the TinyMCE repo
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/django-tinymceto a version that resolves this vulnerability.Fixed in 3.4.0 - Upgrade
Upgrade
nuget/TinyMCEto a version that resolves this vulnerability.Fixed in 5.10.0 - Upgrade
Upgrade
composer/tinymce/tinymceto a version that resolves this vulnerability.Fixed in 5.10.0 - Upgrade
Upgrade
npm/tinymceto a version that resolves this vulnerability.Fixed in 5.10.0 - Upgrade
Upgrade
TinyMCEto a version that resolves this vulnerability.Fixed in 5.10.0 - Configuration
Disable the `image` and `link` plugins in TinyMCE to mitigate the XSS issue in the URL processing logic.
TinyMCE plugins.image and plugins.link = disabled
Event History
Frequently Asked Questions
What is the severity of CVE-2024-21910?
CVE-2024-21910 is classified as a cross-site scripting vulnerability affecting TinyMCE versions prior to 5.10.0.
How do I fix CVE-2024-21910?
To mitigate CVE-2024-21910, upgrade TinyMCE to version 5.10.0 or later.
Which versions of TinyMCE are affected by CVE-2024-21910?
TinyMCE versions before 5.10.0 are affected by CVE-2024-21910.
Can CVE-2024-21910 be exploited remotely?
Yes, CVE-2024-21910 can be exploited remotely through a cross-site scripting attack.
Is there a patch for CVE-2024-21910 available?
Yes, the patch for CVE-2024-21910 is included in TinyMCE version 5.10.0 and later.