GitStock

wenzhixin/bootstrap-table · Security

Cross-site Scripting in bootstrap-table

GHSA ID
GHSA-mw6q-98mp-g8g8
CVE ID
CVE-2021-23472
Severity
low
Published
Updated
CVSS
3.1 · CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
CVSS v3
3.1 · CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

Description

This affects all versions of package bootstrap-table. A type confusion vulnerability can lead to a bypass of input sanitization when the input provided to the escapeHTML function is an array (instead of a string) even if the escape attribute is set.

CWEs

  • CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
  • CWE-843 · Access of Resource Using Incompatible Type ('Type Confusion')

References