GHSA-vjwg-28gv-pm8h: 
PHP vulnerability analysis and mitigation

A security vulnerability was identified in Pimcore TinyMCE Bundle affecting versions >= 11.2.0, < 11.2.3 and >= 11.0.0-ALPHA1, < 11.1.6.5. The issue stems from the usage of TinyMCE version 6.7.3 which contains known vulnerabilities. This moderate severity issue was disclosed on April 24, 2024, and received a CVSS score of 6.1 (GitHub Advisory).

The vulnerability has been assigned a CVSS v3.1 base score of 6.1 with the following metrics: Network attack vector, Low attack complexity, No privileges required, User interaction Required, Changed scope, Low confidentiality impact, Low integrity impact, and No availability impact (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). The vulnerability is associated with CWE-79 and CWE-1395 (GitHub Advisory).

The vulnerability potentially allows for XSS (Cross-Site Scripting) attacks in systems using the affected versions of Pimcore TinyMCE Bundle (GitHub Advisory).

The vulnerability requires network access and user interaction for exploitation, with no privileges required, as indicated by the CVSS metrics (GitHub Advisory).

Users are advised to upgrade Pimcore to either release 11.2.3 or 11.1.6.5, which include TinyMCE version 6.8.1 or higher to address the XSS vulnerability (GitHub Advisory).