NuGet/TinyMCE CVE-2022-23494: medium 5.4, EPSS 1.01%
Cross-site scripting vulnerability in TinyMCE alerts
Action: Upgrade TinyMCE to 5.10.7 (5.x) or 6.3.1 (6.x) or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 6.0.0 | 6.3.1 | - |
| 0 | 5.10.7 | - |
Fixed versions
| 6.3.1 | 5.10.7 |
Sources
- osv: GHSA-gg8r-xjwq-4w92#NuGet/TinyMCE
- https://github.com/tinymce/tinymce/security/advisories/GHSA-gg8r-xjwq-4w92
- https://nvd.nist.gov/vuln/detail/CVE-2022-23494
- https://github.com/tinymce/tinymce/commit/6923d85eba6de3e08ebc9c5a387b5abdaa21150e
- https://github.com/tinymce/tinymce/commit/8bb2d2646d4e1a718fce61a775fa22e9d317b32d
- https://github.com/tinymce/tinymce
- https://www.tiny.cloud/docs/release-notes/release-notes5107/#securityfixes
- https://www.tiny.cloud/docs/tinymce/6/6.3-release-notes/#security-fixes
- https://www.tiny.cloud/docs/tinymce/6/file-image-upload/#images_upload_handler
CVE-2022-23494 · published · modified · JSON