PT-2019-7542 · Select2 · Select2

Uberbrady · Publicado 2019-03-27 · Atualizado 2022-05-14 · CVE-2016-10744

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Select2 versions through 4.0.5

Description The issue allows for XSS in certain use cases, specifically when using Ajax remote data loading and HTML templates to display listbox data. This affects rich selectlists.

Recommendations For versions through 4.0.5, consider disabling the use of HTML templates for displaying listbox data until a patch is available. Restrict access to features that utilize Ajax remote data loading to minimize the risk of exploitation.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2016-10744

GHSA-RF66-HMQF-Q3FC

Produtos afetados

Select2

Referências · 7

• https://github.com/select2/select2/issues/4587 · Nota
• https://github.com/select2/select2 · Nota
• https://github.com/snipe/snipe-it/pull/6831 · Correção
• https://github.com/snipe/snipe-it/pull/6831/commits/5848d9a10c7d62c73ff6a3858edfae96a429402a · Correção
• https://osv.dev/vulnerability/GHSA-rf66-hmqf-q3fc · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2016-10744 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2016-10744 · Aviso do Fabricante