CVE-2021-23445: Cross-site Scripting (XSS)
Cross-site Scripting (XSS)
Other sources
datatables.net is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability to inject malicious script into a web page which would be executed in a victim's Web browser within the security context of the hosting Web site, once the page is viewed. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials.
— IBM
This affects the package datatables.net before 1.11.3. If an array is passed to the HTML escape entities function it would not have its contents escaped.
— GitHub
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the vulnerability ID of this vulnerability?
The vulnerability ID is CVE-2021-23445.
What is the severity rating of CVE-2021-23445?
The severity rating of CVE-2021-23445 is 7.2 (high).
What software packages are affected by CVE-2021-23445?
The package datatables.net before version 1.11.3 is affected by CVE-2021-23445.
What is the impact of CVE-2021-23445?
CVE-2021-23445 allows remote attackers to inject malicious scripts into web pages, which could be executed in a victim's web browser within the security context of the hosting web server.
How can CVE-2021-23445 be fixed?
To fix CVE-2021-23445, update the datatables.net package to version 1.11.3 or later.