Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS1tMmhtLWhycjItNnAycc4AAq8b

Cross-site Scripting in Bootstrap-3-Typeahead

Bootstrap-3-Typeahead after version 4.0.2 is vulnerable to a cross-site scripting flaw in the highlighter() function. An attacker could exploit this via user interaction to execute code in the user's browser. This issue was introduced in commit dbd1af5bf and has not been fixed.

Permalink: https://github.com/advisories/GHSA-m2hm-hrr2-6p2q
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1tMmhtLWhycjItNnAycc4AAq8b
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: almost 2 years ago
Updated: about 1 year ago

CVSS Score: 6.1
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Identifiers: GHSA-m2hm-hrr2-6p2q, CVE-2019-10215
References:

• https://nvd.nist.gov/vuln/detail/CVE-2019-10215
• https://access.redhat.com/errata/RHSA-2019:3771
• https://github.com/bassjobsen/Bootstrap-3-Typeahead
• http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00083.html
• https://github.com/bassjobsen/Bootstrap-3-Typeahead/commit/dbd1af5bfb14592213e3d88f1fa8f726b93f8a1e
• https://access.redhat.com/security/cve/CVE-2019-10215
• https://bugzilla.redhat.com/show_bug.cgi?id=1735506
• https://github.com/advisories/GHSA-m2hm-hrr2-6p2q

Repository: https://github.com/bassjobsen/Bootstrap-3-Typeahead
Blast Radius: 25.0

Affected Packages