GitHub Advisoryadvisory · Packagist

GHSA-jxcx-3h54-qqxx SilverStripe CMS Cross-site Scripting vulnerabilities inherited from TinyMCE

MEDIUM Published 2023-08-23 Modified 2023-08-23 Official page ↗
Ecosystem
Packagist
Packages
silverstripe/admin
Severity
Moderate
Weaknesses
CWE-79
Reviewed
2023-08-23

Affected packages

• Packagist silverstripe/admin: >= 1.0.0, < 1.13.6 → fixed in 1.13.6

Description

TinyMCE 4.x is vulnerable to several XSS vectors, which had been patched in later versions. Two of these have been identified as affecting silverstripe/admin. Only Silverstripe CMS 4 is affected by these vulnerabilities. It's not possible to upgrade Silverstripe CMS 4 to use a more recent release of TinyMCE without introducing breaking changes. Instead, the security patches that shipped in later releases of TinyMCE have been backported to the TinyMCE version bundled in silverstripe/admin. Silverstripe CMS 5 is not affected by these vulnerabilities because it uses TinyMCE 6.

Related

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References