CVE-2023-45819: TinyMCE XSS vulnerability in notificationManager.open API

CVE-2023-45819 · Severity: low · CVSS 3.1 · Published 2023-10-19

TinyMCE is a popular rich-text editor component used in web applications and content management systems. An attacker can exploit an XSS vulnerability in the notification manager to execute arbitrary JavaScript code in a user's browser session, potentially leading to account compromise, data theft, or unauthorized actions performed on behalf of the user.

Technologies: tinymce (npm), TinyMCE (NuGet), tinymce/tinymce (Packagist). Vendors: npm, NuGet, Packagist.

Quick answers

Is CVE-2023-45819 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2023-45819 being exploited in the wild.
How severe is CVE-2023-45819?
Low severity, with a CVSS score of 3.1, published 19 October 2023.
Which products and versions are affected?
tinymce (npm) SEMVER:introduced=6.0.0,fixed=6.7.1; TinyMCE (NuGet) ECOSYSTEM:introduced=6.0.0,fixed=6.7.1; tinymce/tinymce (Packagist) ECOSYSTEM:introduced=6.0.0,fixed=6.7.1.
Is there a fix for CVE-2023-45819?
Yes. tinymce (npm): upgrade to 6.7.1 or later; TinyMCE (NuGet): upgrade to 6.7.1 or later; tinymce/tinymce (Packagist): upgrade to 6.7.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2023-45819 attacked?
It is attacked over the network.
Am I affected by CVE-2023-45819?
Check whether you run tinymce (npm), TinyMCE (NuGet) or tinymce/tinymce (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • tinymce (npm): upgrade to 6.7.1 or later
    npm install tinymce@6.7.1
  • TinyMCE (NuGet): upgrade to 6.7.1 or later
    dotnet add package TinyMCE --version 6.7.1
  • tinymce/tinymce (Packagist): upgrade to 6.7.1 or later
    composer require tinymce/tinymce:^6.7.1

Technical details

A cross-site scripting (XSS) vulnerability exists in TinyMCE's Notification Manager API (notificationManager.open) due to unfiltered HTML rendering in notification messages. The vulnerability is triggered when malicious content is inserted into the editor and a notification is subsequently displayed; the text parameter's HTML is rendered without sanitization, allowing arbitrary JavaScript execution in the user's browser context. Attack requires user interaction (triggering a notification) and network access to a TinyMCE-enabled application, but no authentication or special privileges. The vulnerability affects TinyMCE versions prior to 5.10.8 and 6.7.1. Patches are available and have been released to both major version branches.

Affected products

  • Tiny Technologies TinyMCE < 5.10.8, >= 6.0.0 and < 6.7.1

Identifiers

  • CVE-2023-45819
  • GHSA-hgqx-r2hp-jr38

Timeline

  • 2023-10-19: disclosed: Advisory GHSA-hgqx-r2hp-jr38 published
  • 2023-10-19: patched: TinyMCE 5.10.8 and 6.7.1 released with patches

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.