This affects versions before 1.19.1 of package bootstrap-table. A type confusion vulnerability can lead to a bypass of input sanitization when the input provided to the escapeHTML function is an array (instead of a string) even if the escape attribute is set.
References
Configurations
History
21 Nov 2024, 05:51
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : 4.3
v3 : 3.1 |
| References | () https://github.com/wenzhixin/bootstrap-table/blob/develop/src/utils/index.js%23L218 - Broken Link, Third Party Advisory | |
| References | () https://security.snyk.io/vuln/SNYK-JS-BOOTSTRAPTABLE-1657597 - Exploit, Patch, Third Party Advisory | |
| References | () https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1910690 - Exploit, Mitigation, Third Party Advisory, VDB Entry | |
| References | () https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1910689 - Exploit, Mitigation, Third Party Advisory, VDB Entry | |
| References | () https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBWENZHIXIN-1910687 - Exploit, Mitigation, Third Party Advisory, VDB Entry | |
| References | () https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1910688 - Exploit, Mitigation, Third Party Advisory, VDB Entry | |
| References | () https://snyk.io/vuln/SNYK-JS-BOOTSTRAPTABLE-1657597 - Exploit, Mitigation, Third Party Advisory, VDB Entry |
Information
Published : 2021-11-03 18:15
Updated : 2024-11-21 05:51
NVD link : CVE-2021-23472
Mitre link : CVE-2021-23472
CVE.ORG link : CVE-2021-23472
JSON object : View
Products Affected
bootstrap-table
- bootstrap_table
CWE
CWE-843
Access of Resource Using Incompatible Type ('Type Confusion')