CVE-2022-1726 Cross-site Scripting in bootstrap-table
Cross-site scripting in Bootstrap Table allows attackers to steal session cookies and data when the HTML content export option is enabled.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2022-1726?
CVE-2022-1726 is a medium-severity cross-site scripting vulnerability in wenzhixin/bootstrap-table, published on 16 May 2022. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Bootstrap Tables XSS vulnerability with Table Export plug-in when exportOptions: htmlContent is true in GitHub repository wenzhixin/bootstrap-table prior to 1.20.2. Disclosing session cookies, disclosing secure session data, exfiltrating data to third-parties.
Weakness: CWE-79
Which versions are affected by CVE-2022-1726?
2 open source packages ship an affected version, including bootstrap-table. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
bootstrap-table npm | All versions | 1.20.2 |
bootstrap-table npm | All versions | 1.20.2 |
Products include Bootstrap-Table Bootstrap Table.
How do I fix CVE-2022-1726?
Upgrade bootstrap-table to 1.20.2 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2022-1726 being exploited?
There is no known exploitation of CVE-2022-1726 in the wild and no public exploit code.
Other vulnerabilities in wenzhixin/bootstrap-table
Sources
Also known as DEBIAN-CVE-2022-1726, GHSA-grw5-g9h2-wpg8, UBUNTU-CVE-2022-1726.