PT-2019-7542 · Select2 · Select2

Uberbrady · Published 2019-03-27 · Updated 2022-05-14 · CVE-2016-10744

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Select2 versions through 4.0.5

Description The issue allows for XSS in certain use cases, specifically when using Ajax remote data loading and HTML templates to display listbox data. This affects rich selectlists.

Recommendations For versions through 4.0.5, consider disabling the use of HTML templates for displaying listbox data until a patch is available. Restrict access to features that utilize Ajax remote data loading to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2016-10744

GHSA-RF66-HMQF-Q3FC

Affected Products

Select2

References · 7

• https://github.com/snipe/snipe-it/pull/6831 · Patch
• https://github.com/snipe/snipe-it/pull/6831/commits/5848d9a10c7d62c73ff6a3858edfae96a429402a · Patch
• https://osv.dev/vulnerability/GHSA-rf66-hmqf-q3fc · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-10744 · Security Note
• https://osv.dev/vulnerability/CVE-2016-10744 · Vendor Advisory
• https://github.com/select2/select2/issues/4587 · Note
• https://github.com/select2/select2 · Note