Vulnerability · Published Jun 24, 2021 · Assigned by snyk
CVE-2021-23398Cross-site Scripting (XSS)
Medium 6.1
In plain English
A medium-severity security flaw in react-bootstrap-table. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.3% (higher than 71% of all known vulnerabilities).
Severity (CVSS 3.1)6.1Medium
Exploit odds (30 days)1.3%top 28.6% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
All versions of package react-bootstrap-table are vulnerable to Cross-site Scripting (XSS) via the dataFormat parameter. The problem is triggered when an invalid React element is returned, leading to dangerouslySetInnerHTML being used, which does not sanitize the output.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | react-bootstrap-table | no fix listed | GHSA-2589-w6xf-983r |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | react-bootstrap-table | 0 – before unspecified |
References
- https://snyk.io/vuln/SNYK-JS-REACTBOOTSTRAPTABLE-1314285 x_refsource_MISC
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1314286 x_refsource_MISC
- https://github.com/AllenFang/react-bootstrap-table/blob/26d07defab759e4f9bce22d1d568690830b8d9d7/src/TableBody.js%23L114-L118 x_refsource_MISC
- https://github.com/AllenFang/react-bootstrap-table/issues/2071 x_refsource_MISC