PT-2021-15490 · Unknown · React-Bootstrap-Table

Michael Rodov · Published 2021-06-24 · Updated 2021-12-10 · CVE-2021-23398

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions react-bootstrap-table versions (all versions)

Description The issue is related to Cross-site Scripting (XSS) via the dataFormat parameter. It occurs when an invalid React element is returned, causing dangerouslySetInnerHTML to be used without proper output sanitization.

Recommendations For all versions, consider restricting the use of the dataFormat parameter until a fix is available, or ensure that only sanitized input is passed to this parameter to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-23398

GHSA-2589-W6XF-983R

SNYK-JAVA-ORGWEBJARSNPM-1314286

SNYK-JS-REACTBOOTSTRAPTABLE-1314285

Affected Products

React-Bootstrap-Table

References · 7

• 🔥 https://github.com/AllenFang/react-bootstrap-table/issues/2071 · Exploit
• 🔥 https://snyk.io/vuln/SNYK-JS-REACTBOOTSTRAPTABLE-1314285 · Exploit
• 🔥 https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1314286 · Exploit
• https://osv.dev/vulnerability/CVE-2021-23398 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-23398 · Security Note
• https://osv.dev/vulnerability/GHSA-2589-w6xf-983r · Vendor Advisory
• https://github.com/AllenFang/react-bootstrap-table/blob/26d07defab759e4f9bce22d1d568690830b8d9d7/src/TableBody.js%23L114-L118 · Note