Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS1tdzZxLTk4bXAtZzhnOM0W5Q

Cross-site Scripting in bootstrap-table

This affects all versions of package bootstrap-table. A type confusion vulnerability can lead to a bypass of input sanitization when the input provided to the escapeHTML function is an array (instead of a string) even if the escape attribute is set.

Permalink: https://github.com/advisories/GHSA-mw6q-98mp-g8g8
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1tdzZxLTk4bXAtZzhnOM0W5Q
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Low
Classification: General
Published: almost 3 years ago
Updated: over 1 year ago

CVSS Score: 3.1
CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

Identifiers: GHSA-mw6q-98mp-g8g8, CVE-2021-23472
References:

• https://nvd.nist.gov/vuln/detail/CVE-2021-23472
• https://snyk.io/vuln/SNYK-JS-BOOTSTRAPTABLE-1657597
• https://github.com/wenzhixin/bootstrap-table/blob/develop/src/utils/index.js%23L218
• https://security.snyk.io/vuln/SNYK-JS-BOOTSTRAPTABLE-1657597
• https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1910690
• https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1910689
• https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBWENZHIXIN-1910687
• https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1910688
• https://github.com/advisories/GHSA-mw6q-98mp-g8g8

Repository: https://github.com/wenzhixin/bootstrap-table
Blast Radius: 9.5

Affected Packages