Description

This affects versions before 1.19.1 of package bootstrap-table. A type confusion vulnerability can lead to a bypass of input sanitization when the input provided to the escapeHTML function is an array (instead of a string) even if the escape attribute is set.

Remediation

References

CVE-2021-23472

Related Vulnerabilities

WordPress Plugin Social Metrics Tracker Cross-Site Scripting (1.6.8)

WordPress Plugin Awesome Support-WordPress HelpDesk & Support Cross-Site Scripting (6.0.5)

WordPress Plugin Jetpack-WP Security, Backup, Speed, & Growth Cross-Site Scripting (3.5.2)

MySQL CVE-2017-10365 Vulnerability (CVE-2017-10365)

MediaWiki CVE-2017-8812 Vulnerability (CVE-2017-8812)

Severity

Medium

Classification

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Tags

Missing Update Known Vulnerabilities CWE-843 CVE-2021-23472