Is CVE-2020-17480 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2020-17480 being exploited in the wild.

How severe is CVE-2020-17480?

Informational severity, with a CVSS score of 6.1, published 30 January 2020.

Which products and versions are affected?

Tiny Technologies TinyMCE = 5.0.0 < 5.1.4.

Is there a fix for CVE-2020-17480?

A patch was published on 2019-12-18: TinyMCE 5.1.4 released with security fixes. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2020-17480 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2020-17480?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2020-17480: Tiny Technologies TinyMCE XSS in core parser and plugins

Q: Is there a fix for CVE-2020-17480?

A patch was published on 2019-12-18: TinyMCE 5.1.4 released with security fixes. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2020-17480 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2020-17480?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2020-17480 · Severity: info · CVSS 6.1 · Published 2020-01-30

TinyMCE is a widely used rich-text editor library integrated into many web applications to allow users to create and format content. A security flaw was found where the editor fails to properly clean content when it is pasted from the clipboard or inserted via automated tools. This could allow an attacker to execute malicious scripts in the browser of another user, potentially leading to unauthorized actions or data theft within the affected application.

Quick answers

Is CVE-2020-17480 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2020-17480 being exploited in the wild.
How severe is CVE-2020-17480?: Informational severity, with a CVSS score of 6.1, published 30 January 2020.
Which products and versions are affected?: Tiny Technologies TinyMCE < 4.9.7, >= 5.0.0 < 5.1.4.
Is there a fix for CVE-2020-17480?: A patch was published on 2019-12-18: TinyMCE 5.1.4 released with security fixes. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2020-17480 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2020-17480?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A cross-site scripting (XSS) vulnerability exists in TinyMCE's core parser, as well as the 'paste' and 'visualchars' plugins. The issue stems from improper HTML sanitization and logic errors in how the editor handles HTML-like text and comments during content insertion. An attacker can exploit this by crafting malicious content that, when pasted into the editor or inserted via APIs, executes arbitrary JavaScript in the context of the user's session. The vulnerability is resolved in versions 4.9.7 and 5.1.4 through improved parser logic and enhanced sanitization routines.

Affected products

Tiny Technologies TinyMCE < 4.9.7, >= 5.0.0 < 5.1.4

Identifiers

CVE-2020-17480
GHSA-27gm-ghr9-4v95

Timeline

2019-12-18: patched: TinyMCE 5.1.4 released with security fixes.
2020-01-29: advisory: GitHub security advisory published.
2020-08-10: disclosed: NVD published the CVE record.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.