silverstripe/silverstripe-admin · Security
SilverStripe CMS Cross-site Scripting vulnerabilities inherited from TinyMCE
- GHSA ID
- GHSA-jxcx-3h54-qqxx
- Severity
- medium
- Published
- Updated
Description
TinyMCE 4.x is vulnerable to several XSS vectors, which had been patched in later versions. Two of these have been identified as affecting silverstripe/admin.
Only Silverstripe CMS 4 is affected by these vulnerabilities. It's not possible to upgrade Silverstripe CMS 4 to use a more recent release of TinyMCE without introducing breaking changes. Instead, the security patches that shipped in later releases of TinyMCE have been backported to the TinyMCE version bundled in silverstripe/admin.
Silverstripe CMS 5 is not affected by these vulnerabilities because it uses TinyMCE 6.
CWEs
- CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')