GHSA-vjwg-28gv-pm8h

Pimcore TinyMCE Bundle - tinymce CVE-2024-29203, CVE-2024-29881

6.1 MediumFix available

GHSA-vjwg-28gv-pm8h is a medium vulnerability (CVSS 6.1) in pimcore/pimcore, published April 24, 2024. No source lists public exploit code. Fixed in pimcore/pimcore 11.2.3.

What does this mean?

Severity: 6.1 MediumCVSS 3.1, GitHub Advisories
Exploit chance: UnscoredNo EPSS score yet
Exploitation: None knownNot on CISA’s or ENISA’s lists
Fixed in: 11.2.3pimcore/pimcore +3 more

Description

Impact

The TineMCE Bundle uses tinymce version 6.7.3. CVEs for this version exists for <6.8.1: https://nvd.nist.gov/vuln/detail/CVE-2024-29203 https://nvd.nist.gov/vuln/detail/CVE-2024-29881

Patches

The package should be updated to at least 6.8.1 to avoid XSS vulnerability.

Workarounds

Upgrade pimcore to release 11.2.3 or 11.1.6.5.

References

https://nvd.nist.gov/vuln/detail/CVE-2024-29203 https://nvd.nist.gov/vuln/detail/CVE-2024-29881

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: Low
Integrity: Low
Availability: None

Affected packages

Affected packages
Package	Affected	Fixed
`pimcore/pimcore` Packagist	11.2.0 up to 11.2.3	11.2.3
`pimcore/pimcore` Packagist	11.0.0-ALPHA1 up to 11.1.6.5	11.1.6.5
`pimcore/pimcore` Packagist	11.2.0 up to 11.2.3, plus listed versions v11.2.0v11.2.1v11.2.2	11.2.3
`pimcore/pimcore` Packagist	11.0.0-ALPHA1 up to 11.1.6.5, plus listed versions v11.0.0v11.0.0-ALPHA1v11.0.0-ALPHA2v11.0.0-ALPHA3v11.0.0-ALPHA4 Show 27 moreShow less v11.0.0-ALPHA5v11.0.0-ALPHA6v11.0.0-ALPHA7v11.0.0-ALPHA8v11.0.0-BETA1v11.0.0-RC1v11.0.0-RC2v11.0.1v11.0.10v11.0.11v11.0.12v11.0.2v11.0.3v11.0.4v11.0.5v11.0.6v11.0.7v11.0.8v11.0.9v11.1.0v11.1.0-RC1v11.1.1v11.1.2v11.1.3v11.1.4v11.1.5v11.1.6	11.1.6.5

What each source reports

GitHub Advisories Score used6.1

Pimcore TinyMCE Bundle - tinymce CVE-2024-29203, CVE-2024-29881

Impact

The TineMCE Bundle uses tinymce version 6.7.3. CVEs for this version exists for <6.8.1: https://nvd.nist.gov/vuln/detail/CVE-2024-29203 https://nvd.nist.gov/vuln/detail/CVE-2024-29881

Patches

The package should be updated to at least 6.8.1 to avoid XSS vulnerability.

Workarounds

Upgrade pimcore to release 11.2.3 or 11.1.6.5.

References

https://nvd.nist.gov/vuln/detail/CVE-2024-29203 https://nvd.nist.gov/vuln/detail/CVE-2024-29881

Record: GHSA-vjwg-28gv-pm8h
CVSS 3.1: 6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness: CWE-79, CWE-1395
Updated: 2026-11-02

OSV6.1

Pimcore TinyMCE Bundle - tinymce CVE-2024-29203, CVE-2024-29881

Impact

The TineMCE Bundle uses tinymce version 6.7.3. CVEs for this version exists for <6.8.1: https://nvd.nist.gov/vuln/detail/CVE-2024-29203 https://nvd.nist.gov/vuln/detail/CVE-2024-29881

Patches

The package should be updated to at least 6.8.1 to avoid XSS vulnerability.

Workarounds

Upgrade pimcore to release 11.2.3 or 11.1.6.5.

References

https://nvd.nist.gov/vuln/detail/CVE-2024-29203 https://nvd.nist.gov/vuln/detail/CVE-2024-29881

Record: GHSA-vjwg-28gv-pm8h
CVSS 3.1: 6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness: CWE-1395, CWE-79
Updated: 2026-11-02

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	GitHub Advisories, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.