DataTables enhances HTML tables with the ability to sort, filter and page the data in the table very easily. It provides a comprehensive API and set of configuration options, allowing you to consume data from virtually any data source.
This affects the package datatables.net before 1.11.3. If an array is passed to the HTML escape entities function it would not have its contents escaped.
CVE-2021-23445 - Medium Severity Vulnerability
DataTables enhances HTML tables with the ability to sort, filter and page the data in the table very easily. It provides a comprehensive API and set of configuration options, allowing you to consume data from virtually any data source.
Library home page: https://cdnjs.cloudflare.com/ajax/libs/datatables/1.10.18/js/jquery.dataTables.min.js
Path to vulnerable library: /app/static/DataTables-1.10.18/js/jquery.dataTables.min.js
Dependency Hierarchy: - :x: **jquery.dataTables-1.10.18.min.js** (Vulnerable Library)
Found in HEAD commit: 14c8156ef390c86cf51dfd1594dcfca33897712b
Found in base branch: master
This affects the package datatables.net before 1.11.3. If an array is passed to the HTML escape entities function it would not have its contents escaped.
Publish Date: 2021-09-27
URL: CVE-2021-23445
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: Required - Scope: Changed - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: Low - Availability Impact: None
For more information on CVSS3 Scores, click here.Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23445
Release Date: 2021-09-27
Fix Resolution: datatables.net - 1.11.3
Step up your Open Source Security Game with Mend here