GitHub Advisoryadvisory · npm

GHSA-grw5-g9h2-wpg8 Cross-site Scripting in bootstrap-table

MEDIUM Published 2022-05-17 Modified 2022-05-25 Official page ↗
Aliases
CVE-2022-1726
Ecosystem
npm
Packages
bootstrap-table
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:L
Weaknesses
CWE-79
Reviewed
2022-05-25

Affected packages

• npm bootstrap-table: < 1.20.2 → fixed in 1.20.2

Description

Bootstrap Tables XSS vulnerability with Table Export plug-in when exportOptions: htmlContent is true in GitHub repository wenzhixin/bootstrap-table prior to 1.20.2. Disclosing session cookies, disclosing secure session data, exfiltrating data to third-parties.

Related

Alias · CVE (1)

  • CVE-2022-1726 Bootstrap Tables XSS vulnerability with Table Export plug-in when exportOptions: htmlContent is true in GitHub repository… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References