PT-2023-12299 · Jquery · Datatables

Waleed Ibrahim Alhajri · Publicado 2023-03-06 · Atualizado 2025-03-07 · CVE-2021-36713

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions DataTables plug-in version 1.9.2 for jQuery

Description A Cross Site Scripting (XSS) issue allows attackers to run arbitrary code via the sBaseName parameter to the fnCreateCookie function. This affects a version from 2012.

Recommendations For version 1.9.2, consider disabling the fnCreateCookie function or restricting the use of the sBaseName parameter to minimize the risk of exploitation.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2021-36713

Produtos afetados

Datatables

Referências · 12

• 🔥 https://gist.github.com/walhajri/711af9b62f6fb25e66a5d9a490deab98 · Exploit
• https://cve.org/CVERecord?id=CVE-2021-36713 · Nota de Segurança
• https://t.me/cvenotify/45658 · Publicação no Telegram
• https://security.netapp.com/advisory/ntap-20230406-0003 · Nota
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-36713 · Aviso do Fabricante
• https://t.me/cibsecurity/59520 · Publicação no Telegram
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-36713 · Nota
• https://t.me/cvenotify/113842 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2021-36713 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2021-36713 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2021-36713 · Nota de Segurança
• https://cdn.datatables.net/1.9.2/js/jquery.dataTables.js · Nota