Stored cross-site scripting in TinyMCE - CVE-2024-38356

Vulnerability identifier: #VU92821

CSH Severity: Medium

CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]

CVE-ID: CVE-2024-38356

CWE-ID: CWE-79

Exploitation vector: Remote access

Exploit availability: No public exploit available

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data when using the noneditable_regexp option. A remote attacker can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

TinyMCE
Oracle Financial Services Analytical Applications Infrastructure
Zimbra Collaboration
My webMethods Server
IBM Maximo Asset Management
IBM Maximo Application Suite
Ubuntu
roundcube (Ubuntu package)

Install updates from vendor's website.

TinyMCE - addressed in versions 5.11.0, 6.8.4, 7.2.0
Zimbra Collaboration - addressed in versions 9.0.0 Patch 41, 10.0.9, 10.1.1
My webMethods Server - update to 11.1 Fix 1
roundcube (Ubuntu package) - addressed in versions 1.2~beta+dfsg.1-0ubuntu1+esm8, 1.3.6+dfsg.1-1ubuntu0.1~esm8, 1.4.3+dfsg.1-1ubuntu0.1~esm8, 1.5.0+dfsg.1-2ubuntu0.1~esm6, 1.6.6+dfsg-2ubuntu0.1+esm3
IBM Maximo Asset Management - update to 7.6.1.3.22
IBM Maximo Application Suite - addressed in versions 8.10.17, 8.11.14, 9.0.2

• https://github.com/tinymce/tinymce/security/advisories/GHSA-9hcv-j9pv-qmph

• Multiple vulnerabilities in TinyMCE
• Multiple vulnerabilities in Zimbra Collaboration
• Multiple vulnerabilities in IBM Maximo Asset Management
• Cross-site scripting in IBM Maximo Application Suite
• Multiple vulnerabilities in IBM My webMethods Server
• Multiple vulnerabilities in Oracle Financial Services Analytical Applications Infrastructure
• Ubuntu update for roundcube