Staging Environment: Content and features may be unstable or change without notice.
Advisory details: ubuntu_osv / UBUNTU-CVE-2012-4230
Advisory ID ubuntu_osv/UBUNTU-CVE-2012-4230
Aliases CVE-2012-4230
Summary The bbcode plugin in TinyMCE 3.5.8 does not properly enforce the TinyMCE security policy for the (1) encoding directive and (2) valid_elements attribute, which allows attackers to conduct cross-site scripting (XSS) attacks via application-specific vectors, as demonstrated using a textarea element.
Status Published
Exploitability 0.5
Weighted Severity 6.2
Risk 3.1
Affected and Fixed Packages Package Details
Introduced and Fixed Package Commit Patches Package Commit Patches Details
Weaknesses (0)
There are no known CWE.
System Score Found at
ubuntu-priority medium https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2012/UBUNTU-CVE-2012-4230.json
Reference id Reference type URL
http://osvdb.org/91130
http://packetstormsecurity.com/files/120750/TinyMCE-3.5.8-Cross-Site-Scripting.html
http://seclists.org/fulldisclosure/2013/Mar/114
https://ubuntu.com/security/CVE-2012-4230
https://www.cve.org/CVERecord?id=CVE-2012-4230
http://www.madirish.net/554
http://xforce.iss.net/xforce/xfdb/82744
No exploits are available.

No EPSS data available for this advisory.

Patch URL
There are no known patches.
There are no known vectors.

There are no SSVC decisions available.