bassjobsen/bootstrap-3-typeahead · Security
Cross-site Scripting in Bootstrap-3-Typeahead
- GHSA ID
- GHSA-m2hm-hrr2-6p2q
- CVE ID
- CVE-2019-10215
- Severity
- medium
- Published
- Updated
- CVSS
- 6.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- CVSS v3
- 6.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Description
Bootstrap-3-Typeahead after version 4.0.2 is vulnerable to a cross-site scripting flaw in the highlighter() function. An attacker could exploit this via user interaction to execute code in the user's browser. This issue was introduced in commit dbd1af5bf and has not been fixed.
CWEs
- CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
References
- https://nvd.nist.gov/vuln/detail/CVE-2019-10215 ↗
- https://access.redhat.com/errata/RHSA-2019:3771 ↗
- https://github.com/bassjobsen/Bootstrap-3-Typeahead ↗
- http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00083.html ↗
- https://github.com/bassjobsen/Bootstrap-3-Typeahead/commit/dbd1af5bfb14592213e3d88f1fa8f726b93f8a1e ↗
- https://access.redhat.com/security/cve/CVE-2019-10215 ↗
- https://bugzilla.redhat.com/show_bug.cgi?id=1735506 ↗
- https://github.com/advisories/GHSA-m2hm-hrr2-6p2q ↗