PT-2024-11932 · Xuliangzhan · Vxe-Table

I8O21Rxuliangzhan · Published 2024-05-24 · Updated 2026-03-21 · CVE-2023-1001

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions xuliangzhan vxe-table versions up to 3.7.9

Description A problematic issue has been found in the function export of the file packages/textarea/src/textarea.js of the component vxe-textarea. The manipulation of the argument inputValue leads to cross-site scripting. The attack may be initiated remotely.

Recommendations For versions up to 3.7.9, upgrade to version 3.7.10 to address this issue. As a temporary workaround, consider restricting the use of the inputValue argument in the affected component until the upgrade is applied.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-1001

GHSA-2QJP-FG8C-G878

Affected Products

Vxe-Table

References · 12

• https://gitee.com/xuliangzhan_admin/vxe-table/tree/3.7.10 · Patch
• https://gitee.com/xuliangzhan_admin/vxe-table/commit/d70b0e089740b65a22c89c106ebc4627ac48a22d · Patch
• https://osv.dev/vulnerability/GHSA-2qjp-fg8c-g878 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-1001 · Security Note
• https://github.com/x-extends/vxe-table · Note
• https://github.com/x-extends/vxe-table/commit/d70b0e089740b65a22c89c106ebc4627ac48a22d · Note
• https://twitter.com/davidsheyi/status/2035325880306672040 · Twitter Post
• https://vuldb.com/?ctiid.266123 · Note
• https://t.me/cvenotify/80970 · Telegram Post
• https://t.me/cvenotify/80948 · Telegram Post
• https://gitee.com/xuliangzhan_admin/vxe-table/issues/I8O21R · Note
• https://vuldb.com/?id.266123 · Note