Is CVE-2024-21911 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2024-21911 being exploited in the wild.

How severe is CVE-2024-21911?

Informational severity, with a CVSS score of 6.1, published 6 January 2021.

Which products and versions are affected?

tinymce (npm) SEMVER:introduced=0,fixed=5.6.0.

Is there a fix for CVE-2024-21911?

Yes. tinymce (npm): upgrade to 5.6.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2024-21911 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2024-21911?

Check whether you run tinymce (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2024-21911: TinyMCE cross-site scripting in URL sanitization

CVE-2024-21911 · Severity: info · CVSS 6.1 · Published 2021-01-06

TinyMCE is a popular rich text editor used in web applications to allow users to create and edit formatted content. A cross-site scripting (XSS) vulnerability in its URL sanitization logic allows attackers to inject arbitrary JavaScript code when malicious content is pasted or inserted via APIs, potentially leading to account compromise, data theft, or malware distribution affecting all users with editor access.

Technologies: tinymce (npm). Vendors: npm.

Quick answers

Is CVE-2024-21911 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2024-21911 being exploited in the wild.
How severe is CVE-2024-21911?: Informational severity, with a CVSS score of 6.1, published 6 January 2021.
Which products and versions are affected?: tinymce (npm) SEMVER:introduced=0,fixed=5.6.0.
Is there a fix for CVE-2024-21911?: Yes. tinymce (npm): upgrade to 5.6.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2024-21911 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2024-21911?: Check whether you run tinymce (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

tinymce (npm): upgrade to 5.6.0 or later
```
npm install tinymce@5.6.0
```

Technical details

A cross-site scripting vulnerability exists in the URL sanitization logic of TinyMCE's core parser (CWE-79). The vulnerability is triggered when specially crafted content is inserted into the editor via clipboard operations or programmatic APIs. The root cause is insufficient sanitization of URL attributes in iframe, object, and embed elements. An attacker with the ability to provide content to the editor—such as through a compromised paste operation or direct API call—can inject JavaScript that executes in the context of the editor's host page. The vulnerability has been patched in version 5.6.0 with improved URL sanitization; versions 5.5.1 and earlier are affected.

Affected products

Tiny Technologies TinyMCE all versions before 5.6.0

Identifiers

CVE-2024-21911
GHSA-w7jx-j77m-wp65

Timeline

2021-01-06: disclosed: Vulnerability published on GitHub Advisory Database
2021-01-06: patched: Patched in TinyMCE 5.6.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.