CVE-2021-23472

Опубликовано: 03 нояб. 2021

Источник: nvd

CVSS3: 3.1

CVSS3: 6.1

CVSS2: 4.3

EPSS Низкий

Описание

This affects versions before 1.19.1 of package bootstrap-table. A type confusion vulnerability can lead to a bypass of input sanitization when the input provided to the escapeHTML function is an array (instead of a string) even if the escape attribute is set.

Ссылки

https://github.com/wenzhixin/bootstrap-table/blob/develop/src/utils/index.js%23L218
Broken Link
Third Party Advisory
https://security.snyk.io/vuln/SNYK-JS-BOOTSTRAPTABLE-1657597
Exploit
Patch
Third Party Advisory
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1910690
Exploit
Mitigation
Third Party Advisory
VDB Entry
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1910689
Exploit
Mitigation
Third Party Advisory
VDB Entry
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBWENZHIXIN-1910687
Exploit
Mitigation
Third Party Advisory
VDB Entry
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1910688
Exploit
Mitigation
Third Party Advisory
VDB Entry
https://snyk.io/vuln/SNYK-JS-BOOTSTRAPTABLE-1657597
Exploit
Mitigation
Third Party Advisory
VDB Entry
https://github.com/wenzhixin/bootstrap-table/blob/develop/src/utils/index.js%23L218
Broken Link
Third Party Advisory
https://security.snyk.io/vuln/SNYK-JS-BOOTSTRAPTABLE-1657597
Exploit
Patch
Third Party Advisory
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1910690
Exploit
Mitigation
Third Party Advisory
VDB Entry
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1910689
Exploit
Mitigation
Third Party Advisory
VDB Entry
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBWENZHIXIN-1910687
Exploit
Mitigation
Third Party Advisory
VDB Entry
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1910688
Exploit
Mitigation
Third Party Advisory
VDB Entry
https://snyk.io/vuln/SNYK-JS-BOOTSTRAPTABLE-1657597
Exploit
Mitigation
Third Party Advisory
VDB Entry

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:bootstrap-table:bootstrap_table:*:*:*:*:*:*:*:*

Версия до 1.19.1 (исключая)

EPSS

Процентиль: 68%

0.00577

Низкий

3.1 Low

CVSS3

6.1 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-843

Связанные уязвимости

CVE-2021-23472

CVSS3: 3.1

ubuntu

больше 4 лет назад

GHSA-mw6q-98mp-g8g8

CVSS3: 3.1

github

около 4 лет назад

Cross-site Scripting in bootstrap-table

BDU:2022-00108

CVSS3: 6.1

fstec

больше 4 лет назад

Уязвимость функции escapeHTML программного средства Bootstrap Table, позволяющая нарушителю отказать воздействие на конфиденциальность и целостность защищаемой информации

EPSS

Процентиль: 68%

0.00577

Низкий

3.1 Low

CVSS3

6.1 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-843