TinyMCE is an open source rich text editor. A mutation cross-site scripting (mXSS) vulnerability was discovered in TinyMCE’s core undo and redo functionality. When a carefully-crafted HTML snippet passes the XSS sanitisation layer, it is manipulated as a string by internal trimming functions before being stored in the undo stack. If the HTML snippet is restored from the undo stack, the combination of the string manipulation and reparative parsing by either the browser's native [DOMParser API](https://developer.mozilla.org/en-US/docs/Web/API/DOMParser) (TinyMCE 6) or the SaxParser API (TinyMCE 5) mutates the HTML maliciously, allowing an XSS payload to be executed. This vulnerability has been patched in TinyMCE 5.10.8 and TinyMCE 6.7.1 by ensuring HTML is trimmed using node-level manipulation instead of string manipulation. Users are advised to upgrade. There are no known workarounds for this vulnerability.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - TinyMCE is an open source rich text editor. A mutation cross-site scripting (mXSS) vulnerability was     discovered in TinyMCE's core undo and redo functionality. When a carefully-crafted HTML snippet passes the     XSS sanitisation layer, it is manipulated as a string by internal trimming functions before being stored     in the undo stack. If the HTML snippet is restored from the undo stack, the combination of the string     manipulation and reparative parsing by either the browser's native [DOMParser     API](https://developer.mozilla.org/en-US/docs/Web/API/DOMParser) (TinyMCE 6) or the SaxParser API (TinyMCE     5) mutates the HTML maliciously, allowing an XSS payload to be executed. This vulnerability has been     patched in TinyMCE 5.10.8 and TinyMCE 6.7.1 by ensuring HTML is trimmed using node-level manipulation     instead of string manipulation. Users are advised to upgrade. There are no known workarounds for this     vulnerability. (CVE-2023-45818)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - TinyMCE is an open source rich text editor. A mutation cross-site scripting (mXSS) vulnerability was
    discovered in TinyMCE’s core undo and redo functionality. When a carefully-crafted HTML snippet passes the
    XSS sanitisation layer, it is manipulated as a string by internal trimming functions before being stored
    in the undo stack. If the HTML snippet is restored from the undo stack, the combination of the string
    manipulation and reparative parsing by either the browser's native [DOMParser
    API](https://developer.mozilla.org/en-US/docs/Web/API/DOMParser) (TinyMCE 6) or the SaxParser API (TinyMCE
    5) mutates the HTML maliciously, allowing an XSS payload to be executed. This vulnerability has been
    patched in TinyMCE 5.10.8 and TinyMCE 6.7.1 by ensuring HTML is trimmed using node-level manipulation
    instead of string manipulation. Users are advised to upgrade. There are no known workarounds for this
    vulnerability. (CVE-2023-45818)

ID	Name	Product	Family	Type	Severity
262283	Linux Distros Unpatched Vulnerability : CVE-2023-45818	Nessus	Misc.	Local	medium
419111	SCA: security update for TinyMCE, tinymce, tinymce/tinymce (GHSA-v65r-p3vv-jjfv)	Tenable Cloud Security	SCA Checks	Local	medium
419111	SCA: security update for TinyMCE, tinymce, tinymce/tinymce (GHSA-v65r-p3vv-jjfv)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium

Detections

Analytics

CVE-2023-45818

medium

Tenable Plugins

medium

medium

medium