PT-2021-5669 · Unknown · Bootstrap-Table
Alessio Della Libera
·
Published
2021-11-03
·
Updated
2023-01-23
·
CVE-2021-23472
CVSS v2.0
5.8
Medium
| Vector | AV:N/AC:M/Au:N/C:P/I:P/A:N |
Name of the Vulnerable Software and Affected Versions
bootstrap-table versions prior to 1.19.1
Description
A type confusion vulnerability can lead to a bypass of input sanitization when the input provided to the
escapeHTML function is an array (instead of a string) even if the escape attribute is set. This issue is related to errors in data type mixing and can potentially allow a remote attacker to compromise the confidentiality and integrity of protected information.Recommendations
For versions prior to 1.19.1, update to version 1.19.1 or later to resolve the issue.
As a temporary workaround, consider disabling the
escapeHTML function until a patch is available.
Restrict input to the escapeHTML function to only accept strings, avoiding arrays, to minimize the risk of exploitation.Exploit
Fix
XSS
Type Confusion
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Bootstrap-Table