TinyMCE is an open source rich text editor. A mutation cross-site scripting (mXSS) vulnerability was discovered in TinyMCE’s core undo/redo functionality and other APIs and plugins. Text nodes within specific parents are not escaped upon serialization according to the HTML standard. If such text nodes contain a special character reserved as an internal marker, they can be combined with other HTML patterns to form malicious snippets. These snippets pass the initial sanitisation layer when the content is parsed into the editor body, but can trigger XSS when the special internal marker is removed from the content and re-parsed. his vulnerability has been patched in TinyMCE versions 6.7.3 and 5.10.9. Users are advised to upgrade. There are no known workarounds for this vulnerability.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - TinyMCE is an open source rich text editor. A mutation cross-site scripting (mXSS) vulnerability was     discovered in TinyMCE's core undo/redo functionality and other APIs and plugins. Text nodes within     specific parents are not escaped upon serialization according to the HTML standard. If such text nodes     contain a special character reserved as an internal marker, they can be combined with other HTML patterns     to form malicious snippets. These snippets pass the initial sanitisation layer when the content is parsed     into the editor body, but can trigger XSS when the special internal marker is removed from the content and     re-parsed. his vulnerability has been patched in TinyMCE versions 6.7.3 and 5.10.9. Users are advised to     upgrade. There are no known workarounds for this vulnerability. (CVE-2023-48219)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - TinyMCE is an open source rich text editor. A mutation cross-site scripting (mXSS) vulnerability was
    discovered in TinyMCE’s core undo/redo functionality and other APIs and plugins. Text nodes within
    specific parents are not escaped upon serialization according to the HTML standard. If such text nodes
    contain a special character reserved as an internal marker, they can be combined with other HTML patterns
    to form malicious snippets. These snippets pass the initial sanitisation layer when the content is parsed
    into the editor body, but can trigger XSS when the special internal marker is removed from the content and
    re-parsed. his vulnerability has been patched in TinyMCE versions 6.7.3 and 5.10.9. Users are advised to
    upgrade. There are no known workarounds for this vulnerability. (CVE-2023-48219)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 9532a361-b84d-11ee-b0d7-84a93843eb75 advisory.

  - TinyMCE is an open source rich text editor. A mutation cross-site scripting (mXSS) vulnerability was     discovered in TinyMCE's core undo/redo functionality and other APIs and plugins. Text nodes within     specific parents are not escaped upon serialization according to the HTML standard. If such text nodes     contain a special character reserved as an internal marker, they can be combined with other HTML patterns     to form malicious snippets. These snippets pass the initial sanitisation layer when the content is parsed     into the editor body, but can trigger XSS when the special internal marker is removed from the content and     re-parsed. his vulnerability has been patched in TinyMCE versions 6.7.3 and 5.10.9. Users are advised to     upgrade. There are no known workarounds for this vulnerability. (CVE-2023-48219)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
262278	Linux Distros Unpatched Vulnerability : CVE-2023-48219	Nessus	Misc.	Local	medium
419098	SCA: security update for TinyMCE, tinymce, tinymce/tinymce (GHSA-v626-r774-j7f8)	Tenable Cloud Security	SCA Checks	Local	medium
419098	SCA: security update for TinyMCE, tinymce, tinymce/tinymce (GHSA-v626-r774-j7f8)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
189397	FreeBSD : TinyMCE -- mXSS in multiple plugins (9532a361-b84d-11ee-b0d7-84a93843eb75)	Nessus	FreeBSD Local Security Checks	Local	medium

Detections

Analytics

CVE-2023-48219

medium

Tenable Plugins

medium

medium

medium

medium