« Volver al listado

CVE-2024-38357

Estado: AplazadaMedia (6.1)—

TinyMCE is an open source rich text editor. A cross-site scripting (XSS) vulnerability was discovered in TinyMCE’s content parsing code. This allowed specially crafted noscript elements containing malicious code to be executed when that content was loaded into the editor. This vulnerability has been patched in TinyMCE 7.2.0, TinyMCE 6.8.4 and TinyMCE 5.11.0 LTS by ensuring that content within noscript elements are properly parsed. Users are advised to upgrade. There are no known workarounds for this vulnerability.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Tinymce — TinymceAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-38357",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-38357",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-06-20T13:07:53.926006Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 6.1,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "tinymce",
          "product": "tinymce",
          "versions": [
            {
              "status": "affected",
              "version": "< 5.11.0"
            },
            {
              "status": "affected",
              "version": ">= 6.0.0, <6.8.4"
            },
            {
              "status": "affected",
              "version": ">= 7.0.0, < 7.2.0"
            }
          ]
        }
      ]
    }
  ],
  "published": "2024-06-19T20:15:11.727",
  "references": [
    {
      "url": "https://github.com/tinymce/tinymce/commit/5acb741665a98e83d62b91713c800abbff43b00d",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/tinymce/tinymce/security/advisories/GHSA-w9jx-4g6g-rp7x",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://owasp.org/www-community/attacks/xss",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://www.tiny.cloud/docs/tinymce/6/6.8.4-release-notes/#overview",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://www.tiny.cloud/docs/tinymce/7/7.2-release-notes/#overview",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/tinymce/tinymce/commit/5acb741665a98e83d62b91713c800abbff43b00d",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/tinymce/tinymce/security/advisories/GHSA-w9jx-4g6g-rp7x",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://owasp.org/www-community/attacks/xss",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.tiny.cloud/docs/tinymce/6/6.8.4-release-notes/#overview",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.tiny.cloud/docs/tinymce/7/7.2-release-notes/#overview",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "TinyMCE is an open source rich text editor. A cross-site scripting (XSS) vulnerability was discovered in TinyMCE’s content parsing code. This allowed specially crafted noscript elements containing malicious code to be executed when that content was loaded into the editor. This vulnerability has been patched in TinyMCE 7.2.0, TinyMCE 6.8.4 and TinyMCE 5.11.0 LTS by ensuring that content within noscript elements are properly parsed. Users are advised to upgrade. There are no known workarounds for this vulnerability.\n"
    },
    {
      "lang": "es",
      "value": "TinyMCE es un editor de texto enriquecido de código abierto. Se descubrió una vulnerabilidad de cross-site scripting (XSS) en el código de análisis de contenido de TinyMCE. Esto permitió que se ejecutaran elementos noscript especialmente manipulados que contenían código malicioso cuando ese contenido se cargaba en el editor. Esta vulnerabilidad se ha solucionado en TinyMCE 7.2.0, TinyMCE 6.8.4 y TinyMCE 5.11.0 LTS garantizando que el contenido dentro de los elementos noscript se analice correctamente. Se recomienda a los usuarios que actualicen. No se conocen workarounds para esta vulnerabilidad."
    }
  ],
  "lastModified": "2026-06-17T07:39:59.210",
  "sourceIdentifier": "security-advisories@github.com"
}