CVE-2020-17480

TinyMCE before 4.9.7 and 5.x before 5.1.4 allows XSS in the core parser, the paste plugin, and the visualchars plugin by using the clipboard or APIs to insert content into the editor.

References

Affected packages

Git / github.com/tinymce/tinymce

Affected ranges

Type

GIT

Repo

https://github.com/tinymce/tinymce

Events

Introduced

Fixed

615f7e7a2b4beb7445fe9dc416b9ccaec646c2f0

Introduced

945bf35afd18fe97415652ae026b538ea7ffa8b8

Fixed

cd7b9a213076a7c2cd1721d82e59ee974d536920

Database specific

{
    "cpe": "cpe:2.3:a:tiny:tinymce:*:*:*:*:*:*:*:*",
    "source": "CPE_FIELD",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "4.9.7"
        },
        {
            "introduced": "5.0.0"
        },
        {
            "fixed": "5.1.4"
        }
    ]
}

Affected versions

2.*

2.0.7

2.0.9

2.1.1

2.1.2

3.*

3.0

3.0.1

3.0.2

3.0.2.1

3.0.3

3.0.4

3.0.5

3.0.6

3.0.7

3.0.9

3.0rc1

3.0rc2

3.1.0

3.2

3.2.0.2

3.2.1

3.2.1.1

3.2.2

3.2.2.1

3.2.2.2

3.2.3

3.2.6

3.2.7

3.3

3.3.1

3.3.2

3.3.3

3.3.4

3.3.5

3.3.6

3.3.7

3.3.8

3.3.9

3.3.9.1

3.3.9.2

3.3b1

3.3b2

3.3rc1

3.4

3.4.1

3.4.2

3.4.3

3.4.3.1

3.4.3.2

3.4.4

3.4.5

3.4.6

3.4.7

3.4.8

3.4.9

3.4b1

3.4b2

3.4b3

3.5

3.5.0.1

3.5.1

3.5.1.1

3.5.2

3.5.3

3.5.3.1

3.5.4

3.5.4.1

3.5.5

3.5.6

3.5.7

3.5.8

4.*

4.0

4.0.1

4.0.10

4.0.11

4.0.12

4.0.13

4.0.14

4.0.15

4.0.16

4.0.17

4.0.18

4.0.19

4.0.2

4.0.20

4.0.21

4.0.22

4.0.23

4.0.24

4.0.25

4.0.26

4.0.27

4.0.28

4.0.3

4.0.4

4.0.5

4.0.6

4.0.7

4.0.8

4.0.9

4.0b1

4.0b2

4.0b3

4.1.0

4.1.1

4.1.10

4.1.2

4.1.3

4.1.4

4.1.5

4.1.6

4.1.7

4.1.8

4.1.9

4.2.0

4.2.1

4.2.2

4.2.3

4.2.4

4.2.5

4.2.6

4.2.7

4.3.0

4.3.1

4.3.10

4.3.11

4.3.12

4.3.13

4.3.2

4.3.3

4.3.4

4.3.6

4.3.7

4.3.8

4.3.9

4.4.0

4.4.1

4.4.2

4.4.3

4.5.0

4.5.1

4.5.2

4.5.3

4.6.0

4.6.1

4.6.2

4.6.3

4.6.4

4.6.5

4.6.6

4.6.7

4.7.0

4.7.1

4.7.10

4.7.11

4.7.12

4.7.13

4.7.2

4.7.3

4.7.4

4.7.5

4.7.6

4.7.7

4.7.8

4.7.9

4.8.0

4.8.1

4.8.2

4.8.3

4.8.4

4.8.5

4.9.0

4.9.1

4.9.2

4.9.3

4.9.4

4.9.5

4.9.6

5.*

5.0.14

5.0.15

5.0.16

5.1.0

5.1.1

5.1.2

5.1.3

5.1.4

@ephox/acid@1.*

@ephox/acid@1.0.34

@ephox/acid@1.0.35

@ephox/acid@1.0.36

@ephox/acid@1.0.37

@ephox/acid@1.0.38

@ephox/acid@1.0.39

@ephox/acid@1.0.40

@ephox/acid@1.0.41

@ephox/acid@1.0.42

@ephox/acid@1.0.43

@ephox/acid@1.0.44

@ephox/acid@1.0.45

@ephox/acid@1.0.46

@ephox/acid@1.0.48

@ephox/acid@1.0.50

@ephox/acid@1.0.51

@ephox/acid@1.0.52

@ephox/acid@1.0.53

@ephox/acid@1.0.54

@ephox/acid@1.0.55

@ephox/acid@1.0.57

@ephox/acid@1.0.58

@ephox/acid@1.0.59

@ephox/acid@1.0.60

@ephox/acid@1.0.61

@ephox/acid@1.0.62

@ephox/acid@1.0.63

@ephox/agar@4.*

@ephox/agar@4.13.22

@ephox/agar@4.13.23

@ephox/agar@4.13.24

@ephox/agar@4.13.25

@ephox/agar@4.13.26

@ephox/agar@4.13.27

@ephox/agar@4.13.28

@ephox/agar@4.13.29

@ephox/agar@4.13.30

@ephox/agar@4.13.31

@ephox/agar@4.13.32

@ephox/agar@4.13.33

@ephox/agar@4.13.34

@ephox/agar@4.13.36

@ephox/agar@4.13.38

@ephox/agar@4.13.39

@ephox/agar@4.13.40

@ephox/agar@4.13.41

@ephox/agar@4.14.0

@ephox/agar@4.14.1

@ephox/agar@4.14.3

@ephox/agar@4.14.4

@ephox/agar@4.14.5

@ephox/agar@4.14.6

@ephox/alloy@4.*

@ephox/alloy@4.15.10

@ephox/alloy@4.15.11

@ephox/alloy@4.15.12

@ephox/alloy@4.15.13

@ephox/alloy@4.15.14

@ephox/alloy@4.15.15

@ephox/alloy@4.15.16

@ephox/alloy@4.15.17

@ephox/alloy@4.15.18

@ephox/alloy@4.15.20

@ephox/alloy@4.15.22

@ephox/alloy@4.15.23

@ephox/alloy@4.15.24

@ephox/alloy@4.15.25

@ephox/alloy@4.15.26

@ephox/alloy@4.15.27

@ephox/alloy@4.15.6

@ephox/alloy@4.15.7

@ephox/alloy@4.15.8

@ephox/alloy@4.15.9

@ephox/alloy@5.*

@ephox/alloy@5.0.1

@ephox/alloy@5.0.2

@ephox/alloy@5.0.3

@ephox/alloy@5.0.4

@ephox/alloy@5.0.5

@ephox/alloy@5.0.6

@ephox/alloy@5.0.7

@ephox/boss@3.*

@ephox/boss@3.0.30

@ephox/boss@3.0.31

@ephox/boss@3.0.32

@ephox/boss@3.0.33

@ephox/boss@3.0.34

@ephox/boss@3.0.35

@ephox/boss@3.0.36

@ephox/boss@3.0.37

@ephox/boss@3.0.39

@ephox/boss@3.0.41

@ephox/boss@3.0.42

@ephox/boss@3.0.43

@ephox/boss@3.0.44

@ephox/boss@3.0.46

@ephox/boss@3.0.47

@ephox/boss@3.0.48

@ephox/boulder@3.*

@ephox/boulder@3.3.26

@ephox/boulder@3.3.27

@ephox/boulder@3.3.28

@ephox/boulder@3.3.29

@ephox/boulder@3.3.31

@ephox/boulder@3.3.33

@ephox/boulder@3.3.34

@ephox/boulder@3.3.35

@ephox/boulder@3.3.37

@ephox/boulder@3.3.38

@ephox/bridge@1.*

@ephox/bridge@1.0.74

@ephox/bridge@1.0.75

@ephox/bridge@1.0.76

@ephox/bridge@1.0.77

@ephox/bridge@1.0.78

@ephox/bridge@1.0.80

@ephox/bridge@1.0.81

@ephox/bridge@1.0.83

@ephox/bridge@1.0.84

@ephox/bridge@1.0.85

@ephox/bridge@1.0.86

@ephox/bridge@1.0.88

@ephox/bridge@1.0.89

@ephox/darwin@3.*

@ephox/darwin@3.0.25

@ephox/darwin@3.0.26

@ephox/darwin@3.0.27

@ephox/darwin@3.0.28

@ephox/darwin@3.0.29

@ephox/darwin@3.0.30

@ephox/darwin@3.0.31

@ephox/darwin@3.0.32

@ephox/darwin@3.0.34

@ephox/darwin@3.0.36

@ephox/darwin@3.0.37

@ephox/darwin@3.0.38

@ephox/darwin@3.0.39

@ephox/darwin@4.*

@ephox/darwin@4.0.1

@ephox/darwin@4.0.2

@ephox/darwin@4.0.3

@ephox/darwin@4.0.4

@ephox/darwin@4.0.5

@ephox/dragster@4.*

@ephox/dragster@4.0.22

@ephox/dragster@4.0.23

@ephox/dragster@4.0.24

@ephox/dragster@4.0.25

@ephox/dragster@4.0.26

@ephox/dragster@4.0.27

@ephox/dragster@4.0.28

@ephox/dragster@4.0.29

@ephox/dragster@4.0.31

@ephox/dragster@4.0.33

@ephox/dragster@4.0.34

@ephox/dragster@4.0.35

@ephox/dragster@4.0.36

@ephox/dragster@4.0.38

@ephox/dragster@4.0.39

@ephox/dragster@4.0.40

@ephox/imagetools@3.*

@ephox/imagetools@3.2.5

@ephox/imagetools@3.2.6

@ephox/imagetools@3.2.8

@ephox/jax@4.*

@ephox/jax@4.1.17

@ephox/jax@4.1.18

@ephox/jax@4.1.19

@ephox/jax@4.1.20

@ephox/jax@4.1.22

@ephox/jax@4.1.24

@ephox/jax@4.1.25

@ephox/jax@4.1.26

@ephox/jax@4.1.28

@ephox/katamari@2.*

@ephox/katamari@2.4.28

@ephox/katamari@2.5.0

@ephox/katamari@2.5.1

@ephox/katamari@2.5.2

@ephox/katamari@3.*

@ephox/katamari@3.0.1

@ephox/katamari@4.*

@ephox/katamari@4.0.1

@ephox/katamari@4.0.2

@ephox/katamari@4.0.3

@ephox/katamari@4.0.5

@ephox/mcagar@4.*

@ephox/mcagar@4.0.21

@ephox/mcagar@4.0.22

@ephox/mcagar@4.0.23

@ephox/mcagar@4.0.24

@ephox/mcagar@4.0.25

@ephox/mcagar@4.0.26

@ephox/mcagar@4.0.27

@ephox/mcagar@4.0.28

@ephox/mcagar@4.0.29

@ephox/mcagar@4.0.30

@ephox/mcagar@4.0.31

@ephox/mcagar@4.0.32

@ephox/mcagar@4.0.33

@ephox/mcagar@4.0.35

@ephox/mcagar@4.0.37

@ephox/mcagar@4.0.38

@ephox/mcagar@4.0.39

@ephox/mcagar@4.0.40

@ephox/mcagar@4.0.41

@ephox/mcagar@4.0.42

@ephox/mcagar@4.0.44

@ephox/mcagar@4.0.45

@ephox/mcagar@4.0.46

@ephox/mcagar@4.0.47

@ephox/mcagar@4.0.48

@ephox/phoenix@5.*

@ephox/phoenix@5.0.32

@ephox/phoenix@5.0.33

@ephox/phoenix@5.0.34

@ephox/phoenix@5.0.35

@ephox/phoenix@5.0.36

@ephox/phoenix@5.0.37

@ephox/phoenix@5.0.38

@ephox/phoenix@5.0.39

@ephox/phoenix@5.0.41

@ephox/phoenix@5.0.43

@ephox/phoenix@5.0.44

@ephox/phoenix@5.0.45

@ephox/phoenix@5.0.46

@ephox/phoenix@5.0.48

@ephox/phoenix@5.0.49

@ephox/phoenix@5.0.50

@ephox/polaris@3.*

@ephox/polaris@3.0.32

@ephox/polaris@3.0.33

@ephox/polaris@3.0.34

@ephox/polaris@3.0.35

@ephox/polaris@3.0.37

@ephox/polaris@3.0.39

@ephox/polaris@3.0.40

@ephox/polaris@3.0.41

@ephox/polaris@3.0.43

@ephox/porkbun@4.*

@ephox/porkbun@4.0.19

@ephox/porkbun@4.0.20

@ephox/porkbun@4.0.21

@ephox/porkbun@4.0.22

@ephox/porkbun@4.0.24

@ephox/porkbun@4.0.26

@ephox/porkbun@4.0.27

@ephox/porkbun@4.0.28

@ephox/porkbun@4.0.30

@ephox/robin@7.*

@ephox/robin@7.0.26

@ephox/robin@7.0.27

@ephox/robin@7.0.28

@ephox/robin@7.0.29

@ephox/robin@7.0.30

@ephox/robin@7.0.31

@ephox/robin@7.0.32

@ephox/robin@7.0.33

@ephox/robin@7.0.35

@ephox/robin@7.0.37

@ephox/robin@7.0.38

@ephox/robin@7.0.39

@ephox/robin@7.0.40

@ephox/robin@7.0.42

@ephox/robin@7.0.43

@ephox/robin@7.0.44

@ephox/sand@3.*

@ephox/sand@3.0.10

@ephox/sand@3.0.11

@ephox/sand@3.0.12

@ephox/sand@3.0.3

@ephox/sand@3.0.4

@ephox/sand@3.0.5

@ephox/sand@3.0.6

@ephox/sand@3.0.8

@ephox/sand@3.1.1

@ephox/sand@3.1.2

@ephox/snooker@5.*

@ephox/snooker@5.0.10

@ephox/snooker@5.0.12

@ephox/snooker@5.0.14

@ephox/snooker@5.0.15

@ephox/snooker@5.0.16

@ephox/snooker@5.0.17

@ephox/snooker@5.0.3

@ephox/snooker@5.0.4

@ephox/snooker@5.0.5

@ephox/snooker@5.0.6

@ephox/snooker@5.0.7

@ephox/snooker@5.0.8

@ephox/snooker@5.0.9

@ephox/snooker@5.1.1

@ephox/snooker@5.1.2

@ephox/snooker@5.1.3

@ephox/sugar@5.*

@ephox/sugar@5.0.0

@ephox/sugar@5.0.1

@ephox/sugar@5.0.11

@ephox/sugar@5.0.12

@ephox/sugar@5.0.13

@ephox/sugar@5.0.14

@ephox/sugar@5.0.16

@ephox/sugar@5.0.17

@ephox/sugar@5.0.18

@ephox/sugar@5.0.2

@ephox/sugar@5.0.3

@ephox/sugar@5.0.4

@ephox/sugar@5.0.5

@ephox/sugar@5.0.6

@ephox/sugar@5.0.7

@ephox/sugar@5.0.9

@tinymce/oxide-icons-default@1.*

@tinymce/oxide-icons-default@1.1.1

@tinymce/oxide@1.*

@tinymce/oxide@1.0.233

@tinymce/oxide@1.0.234

@tinymce/oxide@1.0.235

@tinymce/oxide@1.0.236

@tinymce/oxide@1.0.237

@tinymce/oxide@1.0.238

@tinymce/oxide@1.1.1

@tinymce/oxide@1.1.2

@tinymce/oxide@1.1.3

@tinymce/oxide@1.1.4

@tinymce/oxide@1.1.5

@tinymce/oxide@1.1.6

@tinymce/oxide@1.1.7

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2020-17480.json"