Is CVE-2019-1010091 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2019-1010091 being exploited in the wild.

How severe is CVE-2019-1010091?

Informational severity, with a CVSS score of 6.1, published 11 May 2020.

Which products and versions are affected?

tinymce (npm) SEMVER:introduced=0,fixed=4.9.10.

Is there a fix for CVE-2019-1010091?

Yes. tinymce (npm): upgrade to 4.9.10 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2019-1010091 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2019-1010091?

Check whether you run tinymce (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2019-1010091: TinyMCE cross-site scripting via clipboard content

CVE-2019-1010091 · Severity: info · CVSS 6.1 · Published 2020-05-11

TinyMCE is a popular rich-text editor component embedded in web applications and content management systems. An attacker can inject malicious JavaScript code through specially crafted clipboard content or API calls, which executes in the browser of any user editing content—potentially allowing account takeover, data theft, or malware distribution to website visitors.

Technologies: tinymce (npm). Vendors: npm.

Quick answers

Is CVE-2019-1010091 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2019-1010091 being exploited in the wild.
How severe is CVE-2019-1010091?: Informational severity, with a CVSS score of 6.1, published 11 May 2020.
Which products and versions are affected?: tinymce (npm) SEMVER:introduced=0,fixed=4.9.10.
Is there a fix for CVE-2019-1010091?: Yes. tinymce (npm): upgrade to 4.9.10 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2019-1010091 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2019-1010091?: Check whether you run tinymce (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

tinymce (npm): upgrade to 4.9.10 or later
```
npm install tinymce@4.9.10
```

Technical details

A cross-site scripting (CWE-79) vulnerability exists in the core parser and media plugin due to insufficient HTML sanitization and CDATA handling. An attacker can craft malicious content containing JavaScript and insert it via the clipboard or direct API calls. The vulnerable code fails to properly sanitize or filter CDATA sections during parsing, allowing arbitrary script execution in the context of the editor user's session. The vulnerability was patched in TinyMCE 4.9.10 and 5.2.2 through improved HTML parsing and sanitization logic. Workarounds include disabling the media plugin and manually stripping CDATA elements.

Affected products

Tiny Technologies TinyMCE 4.9.9 and lower, 5.0.0 to 5.2.1

Identifiers

CVE-2019-1010091
GHSA-c78w-2gw7-gjv3

Timeline

2020-05-07: disclosed
2020-05-07: patched: Patched in TinyMCE 4.9.10 and 5.2.2

References

https://github.com/tinymce/tinymce/security/advisories/GHSA-c78w-2gw7-gjv3

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.