CVE-2012-4230

Name	CVE-2012-4230
Description	The bbcode plugin in TinyMCE 3.5.8 does not properly enforce the TinyMCE security policy for the (1) encoding directive and (2) valid_elements attribute, which allows attackers to conduct cross-site scripting (XSS) attacks via application-specific vectors, as demonstrated using a textarea element.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	796117

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
tinymce	source	(unstable)	(unfixed)	low		796117

Notes

[buster] - tinymce <no-dsa> (Minor issue)
[stretch] - tinymce <no-dsa> (Minor issue)
[jessie] - tinymce <no-dsa> (Minor issue)
[squeeze] - tinymce <no-dsa> (Minor issue)
[wheezy] - tinymce <no-dsa> (Minor issue)