TinyMCE is an open source rich text editor. A cross-site scripting (XSS) vulnerability was discovered in TinyMCE’s content extraction code. When using the `noneditable_regexp` option, specially crafted HTML attributes containing malicious code were able to be executed when content was extracted from the editor. This vulnerability has been patched in TinyMCE 7.2.0, TinyMCE 6.8.4 and TinyMCE 5.11.0 LTS by ensuring that, when using the `noneditable_regexp` option, any content within an attribute is properly verified to match the configured regular expression before being added. Users are advised to upgrade. There are no known workarounds for this vulnerability.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8223-1 advisory.

    It was discovered that Roundcube Webmail mishandled Punycode xn-- domain names. An attacker could possibly     use this issue to cause a homograph attack. (CVE-2019-15237)

    It was discovered that Roundcube Webmail did not properly sanitize certain attributes when handling CSS     within HTML messages and certain SVG attributes. An attacker could possibly use this issue to cause a     cross-site scripting attack. (CVE-2024-38356, CVE-2024-38357)

    It was discovered that Roundcube Webmail did not properly sanitize certain HTML attributes when rendering     e-mail messages. An attacker could possibly use this issue to cause a cross-site scripting attack.
    (CVE-2024-42008)

    It was discovered that Roundcube Webmail did not properly filter certain CSS token sequences within     rendered e-mail messages. An attacker could possibly use this issue to obtain sensitive information.
    (CVE-2024-42010)

    It was discovered that Roundcube Webmail did not properly treat an SVG tag as an image source within its     HTML sanitizer. An attacker could possibly use this issue to bypass remote image blocking to track email     open actions or potentially bypass access control. (CVE-2026-25916)

    It was discovered that Roundcube Webmail did not properly handle comments within Cascading Style Sheets     (CSS). An attacker could possibly use this issue to perform a CSS injection attack. (CVE-2026-26079)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - TinyMCE is an open source rich text editor. A cross-site scripting (XSS) vulnerability was discovered in     TinyMCE's content extraction code. When using the `noneditable_regexp` option, specially crafted HTML     attributes containing malicious code were able to be executed when content was extracted from the editor.
    This vulnerability has been patched in TinyMCE 7.2.0, TinyMCE 6.8.4 and TinyMCE 5.11.0 LTS by ensuring     that, when using the `noneditable_regexp` option, any content within an attribute is properly verified to     match the configured regular expression before being added. Users are advised to upgrade. There are no     known workarounds for this vulnerability. (CVE-2024-38356)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - TinyMCE is an open source rich text editor. A cross-site scripting (XSS) vulnerability was discovered in
    TinyMCE’s content extraction code. When using the `noneditable_regexp` option, specially crafted HTML
    attributes containing malicious code were able to be executed when content was extracted from the editor.
    This vulnerability has been patched in TinyMCE 7.2.0, TinyMCE 6.8.4 and TinyMCE 5.11.0 LTS by ensuring
    that, when using the `noneditable_regexp` option, any content within an attribute is properly verified to
    match the configured regular expression before being added. Users are advised to upgrade. There are no
    known workarounds for this vulnerability. (CVE-2024-38356)

ID	Name	Product	Family	Severity
311109	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS : Roundcube Webmail vulnerabilities (USN-8223-1)	Nessus	Ubuntu Local Security Checks	medium
262045	Linux Distros Unpatched Vulnerability : CVE-2024-38356	Nessus	Misc.	medium
413291	SCA: security update for TinyMCE, django-tinymce, tinymce, tinymce/tinymce (GHSA-9hcv-j9pv-qmph)	Tenable Cloud Security	SCA Checks	medium
413291	SCA: security update for TinyMCE, django-tinymce, tinymce, tinymce/tinymce (GHSA-9hcv-j9pv-qmph)	Tenable Self-Hosted Container Security	SCA Checks	medium

Detections

Analytics

CVE-2024-38356

medium

Tenable Plugins

medium

medium

medium

medium