GHSA-vjwg-28gv-pm8h
Suggest an improvement- Source
- https://github.com/advisories/GHSA-vjwg-28gv-pm8h
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/04/GHSA-vjwg-28gv-pm8h/GHSA-vjwg-28gv-pm8h.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/GHSA-vjwg-28gv-pm8h
- Published
- 2024-04-24T17:02:33Z
- Modified
- 2024-12-02T05:31:15.498307Z
- Severity
-
- 6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
- Summary
- Pimcore TinyMCE Bundle - tinymce CVE-2024-29203, CVE-2024-29881
- Details
-
Impact
The TineMCE Bundle uses tinymce version 6.7.3. CVEs for this version exists for <6.8.1: https://nvd.nist.gov/vuln/detail/CVE-2024-29203 https://nvd.nist.gov/vuln/detail/CVE-2024-29881
Patches
The package should be updated to at least 6.8.1 to avoid XSS vulnerability.
Workarounds
Upgrade pimcore to release 11.2.3 or 11.1.6.5.
References
https://nvd.nist.gov/vuln/detail/CVE-2024-29203 https://nvd.nist.gov/vuln/detail/CVE-2024-29881
- Database specific
{ "github_reviewed_at": "2024-04-24T17:02:33Z", "cwe_ids": [ "CWE-1395", "CWE-79" ], "severity": "MODERATE", "nvd_published_at": null, "github_reviewed": true }- References
Affected packages
Packagist / pimcore/pimcore
Package
- Name
- pimcore/pimcore
- Purl
- pkg:composer/pimcore/pimcore
Packagist / pimcore/pimcore
Package
- Name
- pimcore/pimcore
- Purl
- pkg:composer/pimcore/pimcore
Affected versions
v11.*
v11.0.0-ALPHA1
v11.0.0-BETA1
v11.0.0-ALPHA2
v11.0.0-ALPHA3
v11.0.0-ALPHA4
v11.0.0-ALPHA5
v11.0.0-ALPHA6
v11.0.0-ALPHA7
v11.0.0-ALPHA8
v11.0.0-RC1
v11.0.0-RC2
v11.0.0
v11.0.1
v11.0.2
v11.0.3
v11.0.4
v11.0.5
v11.0.6
v11.0.7
v11.0.8
v11.0.9
v11.0.10
v11.0.11
v11.0.12
v11.1.0-RC1
v11.1.0
v11.1.1
v11.1.2
v11.1.3
v11.1.4
v11.1.5
v11.1.6