GitHub Advisoryadvisory · npm
GHSA-h73q-5wmj-q8pj Cross site scripting in datatables.net
MEDIUM
Official page ↗
- Aliases
- CVE-2021-23445
- Ecosystem
- npm
- Packages
- datatables.net
- Severity
- Moderate
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- Weaknesses
- CWE-79
- Reviewed
- 2021-09-28
Affected packages
• npm datatables.net: < 1.11.3 → fixed in 1.11.3
Description
This affects the package datatables.net before 1.11.3. If an array is passed to the HTML escape entities function it would not have its contents escaped.
Related
Alias · CVE (1)
- CVE-2021-23445 This affects the package datatables.net before 1.11.3. vulnerability
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2021-23445 advisory
- https://github.com/DataTables/Dist-DataTables/commit/59a8d3f8a3c1138ab08704e783bc52bfe88d7c9b web
- https://cdn.datatables.net/1.11.3 web
- https://github.com/DataTables/Dist-DataTables package
- https://lists.debian.org/debian-lts-announce/2023/08/msg00018.html web
- https://security.netapp.com/advisory/ntap-20240621-0006 web
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1715371 web
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1715376 web
- https://snyk.io/vuln/SNYK-JS-DATATABLESNET-1540544 web