Read the docs
TI-2023-30725 Aliases GHSA-wqm8-jx8r-8rcq

Cross-site scripting vulnerabilities in old version of bundled TinyMCE

Priority LOW 38Published · Updated

Key facts

Attack vector
—
Privileges required
—
User interaction
—
Attack complexity
—
Impact type
—
Confidentiality · integrity · availability
—
Fix status
Fixed

No CVSS vector from any source. Fix status from GitHub.

Summary

An old version of TinyMCE include an XSS vulnerability, which was patched in a later version. This was described by TinyMCE: > A cross-site scripting (XSS) vulnerability was discovered in the core parser. The vulnerability allowed arbitrary JavaScript execution when inserting a specially crafted piece of content into the editor via the clipboard or APIs. This impacts all users who are using TinyMCE 4.9.10 or lower and TinyMCE 5.4.0 or lower. We reviewed the potential impact of this vulnerability within the context of Silverstripe CMS. We concluded this is a medium impact vulnerability given how TinyMCE is used by Silverstripe CMS. Reported by: Developers at ACC

Why it matters now

Fix Fixed silverstripe/admin (Packagist): 1.12.7

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—silverstripe/admin (Packagist)before 1.12.71.12.7Patch availableGHSA-wqm8-jx8r-8rcq
  • silverstripe/admin (Packagist) Vendor— Affected before 1.12.7 Fixed in 1.12.7 Patch available GHSA-wqm8-jx8r-8rcq

Remediation

  • Fix · GHSA-wqm8-jx8r-8rcq silverstripe/admin (Packagist) Fixed in 1.12.7 Advisory →

Timeline

  1. 2026-10-03 Threatist record created from GHSA-wqm8-jx8r-8rcq

References

Advisory 1

Other 5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences