CVE-2021-23398

Cross-site Scripting (XSS)

Medium · published June 24, 2021

CVSS v3.1
6.1
EPSS
1%
Percentile
70.9
In the wild
Unconfirmed
What it is

All versions of package react-bootstrap-table are vulnerable to Cross-site Scripting (XSS) via the dataFormat parameter. The problem is triggered when an invalid React element is returned, leading to dangerouslySetInnerHTML being used, which does not sanitize the output.

The record
Technical detail
CVSS v3.1
6.1 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:P
CVSS v4.0
Not supplied
EPSS
0.01341 · 70.9th percentile
Published
2021-06-24T15:00Z
EPSS history
Timeline
  • 24 JUN 15:00Z
    Cross-site Scripting (XSS)
    cvelistv5