tinyMCE - XSS vulnerability on versions between 5.0.0 and 5.1.4, on the core parser, paste and visualcharts plugins.

Rule number

SN-JSL-TINYMCE-BETWEEN-V500-V514(for ServiceNow)

SF-JSL-TINYMCE-BETWEEN-V500-V514(for Salesforce)

Impact

The vulnerability allowed arbitrary JavaScript execution when inserting a specially crafted piece of content into the editor via the clipboard or APIs.

Remediation

Update tinyMCE to the latest version.

Time to fix

30 min

References

This rule is linked to Common Weakness Enumeration CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')..