tinyMCE – XSS Vulnerability On Versions Under 4.2.0, In Some Default Config Implementations

Impact area

Security

Severity

High

Affected element

ServiceNow

UI Script

Salesforce

Static Resource

Rule number #

SN-JSL-TINYMCE-LESSTHAN-V420 (for ServiceNow)

SF-JSL-TINYMCE-LESSTHAN-V420 (for Salesforce)

Impact #

tinyMCE in versions before 4.2.0 allows XSS attacks via some scripts included in default config implamentations.

Remediation #

Update tinyMCE to the latest version.

Time to fix #

30 min

References #

This rule is linked to Common Weakness Enumeration CWE-79 Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’).