PT-2021-6499 · Unknown · Datatables.Net

Alessio Della Libera · Published 2021-08-12 · Updated 2026-01-03 · CVE-2021-23445

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions datatables.net versions prior to 1.11.3

Description The issue is related to the incorrect handling of an array in the input data by the DataTables plugin, which can allow a remote attacker to compromise data integrity. If an array is passed to the HTML escape entities function, its contents would not be escaped.

Recommendations For versions prior to 1.11.3, update to version 1.11.3 or later to resolve the issue. As a temporary workaround, consider restricting the input to the HTML escape entities function to prevent arrays from being passed to it.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

AZL-66567

BDU:2022-01753

CVE-2021-23445

DLA-3529-1

GHSA-H73Q-5WMJ-Q8PJ

RHSA-2024:3559

RHSA-2024:3560

RHSA-2024:3561

SNYK-JAVA-ORGWEBJARSBOWER-1715371

SNYK-JAVA-ORGWEBJARSNPM-1715376

SNYK-JS-DATATABLESNET-1540544

Affected Products

Datatables.Net

References · 25

• 🔥 https://snyk.io/vuln/SNYK-JS-DATATABLESNET-1540544 · Exploit
• 🔥 https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1715376 · Exploit
• 🔥 https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1715371 · Exploit
• https://github.com/DataTables/Dist-DataTables/commit/59a8d3f8a3c1138ab08704e783bc52bfe88d7c9b · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-23445 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-23445 · Security Note
• https://osv.dev/vulnerability/CVE-2021-23445 · Vendor Advisory
• https://cdn.datatables.net/1.11.3 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-23445 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-3529-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-23445 · Security Note
• https://osv.dev/vulnerability/AZL-66567 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-23445 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-01753 · Security Note
• https://osv.dev/vulnerability/GHSA-h73q-5wmj-q8pj · Vendor Advisory