GHSA-9r7h-6639-v5mw

ghsaUSosv

Cross-Site Scripting in bootstrap-select

view advisory published 2020-09-03Licence: CC-BY-4.0

Versions of `bootstrap-select` prior to 1.13.6 are vulnerable to Cross-Site Scripting (XSS). The package does not escape `title` values on `<option>` tags. This may allow attackers to execute arbitrary JavaScript in a victim's browser. ## Recommendation Upgrade to version 1.13.6 or later.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2019-20921US	medium6.1	1.74% (78th)	—	2020-09-30
bootstrap-select before 1.13.6 allows Cross-Site Scripting (XSS). It does not escape title values in OPTION elements. This may allow attackers to execute arbitrary JavaScript in a…

references

External citations — patches, advisories, analysis.

https://github.com/dimpu/ngx-md/issues/129WEB
https://github.com/snapappointments/bootstrap-selectPACKAGE
https://github.com/snapappointments/bootstrap-select/issues/2199WEB
https://www.npmjs.com/advisories/1522WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan