CVE-2021-23472 Cross-site Scripting (XSS)
An attacker can execute arbitrary scripts by bypassing input sanitization in the bootstrap-table library via type confusion.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2021-23472?
CVE-2021-23472 is a low-severity cross-site scripting vulnerability in bootstrap-table, published on 3 Nov 2021. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
This affects versions before 1.19.1 of package bootstrap-table. A type confusion vulnerability can lead to a bypass of input sanitization when the input provided to the escapeHTML function is an array (instead of a string) even if the escape attribute is set.
Weakness: CWE-843
Which versions are affected by CVE-2021-23472?
2 open source packages ship an affected version, including bootstrap-table. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
bootstrap-table npm | All versions to 1.19.0 | None |
bootstrap-table npm | All versions to 1.19.0 | None |
Products include Bootstrap-Table Bootstrap Table.
How do I fix CVE-2021-23472?
No fix has been published for CVE-2021-23472 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2021-23472 being exploited?
There is no known exploitation of CVE-2021-23472 in the wild and no public exploit code.
Other vulnerabilities in bootstrap-table
Sources
Also known as GHSA-mw6q-98mp-g8g8, UBUNTU-CVE-2021-23472.