{"id":"CVE-2020-12648","published":"2020-08-14T13:52:29Z","modified":"2024-08-04T12:04:22Z","title":"A cross-site scripting (XSS) vulnerability in TinyMCE 5.2.1 and earlier allows remote attackers to inject arbitrary…","vendor":null,"product":null,"tier":"tail","description":{"text":"A cross-site scripting (XSS) vulnerability in TinyMCE 5.2.1 and earlier allows remote attackers to inject arbitrary web script when configured in classic editing mode.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.01803,"percentile":0.78511,"provenance":"source"},"cwes":[],"references":[{"url":"https://labs.bishopfox.com/advisories/tinymce-version-5.2.1","tags":["x_refsource_MISC"]}],"priority":{"score":15.7,"factors":[{"name":"EPSS percentile","points":15.7}]},"affected":[{"ecosystem":"npm","package":"tinymce","vulnerableRanges":["<4.9.11",">=5.0.0, <5.4.1"],"patched":["4.9.11","5.4.1"],"from":["GHSA-vrv8-v4w8-f95h"],"provenance":"source"}],"euvd":{"id":"EUVD-2020-0644","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-tinymce-cve-2020-12648","children":[{"from":"CVE-2020-12648","to":"CVE-2024-29203","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["modules/tinymce/src/core/main/ts/html/ParserFilters.ts"],"commits":["https://github.com/tinymce/tinymce/commit/2b71c922214d388838d930806207a66c14e80f63","https://github.com/tinymce/tinymce/commit/696e43658dc9750ec24fdc4650bd2be9653daf5b","https://github.com/tinymce/tinymce/commit/bcdea2ad14e3c2cea40743fb48c63bba067ae6d1"],"basis":"rarely changed file"}]},{"from":"CVE-2020-12648","to":"CVE-2024-29881","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["modules/tinymce/src/core/main/ts/html/ParserFilters.ts"],"commits":["https://github.com/tinymce/tinymce/commit/2b71c922214d388838d930806207a66c14e80f63","https://github.com/tinymce/tinymce/commit/696e43658dc9750ec24fdc4650bd2be9653daf5b","https://github.com/tinymce/tinymce/commit/bcdea2ad14e3c2cea40743fb48c63bba067ae6d1"],"basis":"rarely changed file"}]}],"packageHistory":[{"cve":"CVE-2020-17480","published":"2020-08-10","fixed":"5.1.4","kev":false},{"cve":"CVE-2019-1010091","published":"2019-07-17","fixed":"5.2.2","kev":false,"link":{"from":"CVE-2019-1010091","to":"CVE-2020-12648","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"npm:tinymce","fromFixed":"5.2.2","toFixed":"5.4.1","daysApart":394},{"kind":"version-step","provenance":"source","package":"npm:tinymce","fromFixed":"4.9.10","toFixed":"4.9.11","daysApart":394}]}},{"cve":"CVE-2020-12648","published":"2020-08-14","fixed":"5.4.1","kev":false},{"cve":"CVE-2024-21911","published":"2024-01-03","fixed":"5.6.0","kev":false},{"cve":"CVE-2024-21908","published":"2024-01-03","fixed":"5.9.0","kev":false},{"cve":"CVE-2024-21910","published":"2024-01-03","fixed":"5.10.0","kev":false}],"package":"npm:tinymce"}}