PT-2021-15490
CVE-2021-23398
·
Published
2021-06-24
·
Updated
2021-12-10
Description by
CVSS 3.1
6.1
MediumMetricsAV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions
react-bootstrap-table versions (all versions)
Description
The issue is related to Cross-site Scripting (XSS) via the
dataFormat parameter. It occurs when an invalid React element is returned, causing dangerouslySetInnerHTML to be used without proper output sanitization.Recommendations
For all versions, consider restricting the use of the
dataFormat parameter until a fix is available, or ensure that only sanitized input is passed to this parameter to minimize the risk of exploitation.Exploitability
Exploit
Fix
Impacts
Researchers
Vendors
Affected products
Found an issue in the description? Have something to add? Feel free to write us 👾