DataTable Vulnerable to Cross-Site Scripting

Description

Cross-site scripting (XSS) vulnerability in the DataTables plugin 1.10.8 and earlier for jQuery allows remote attackers to inject arbitrary web script or HTML via the scripts parameter to media/unit_testing/templates/6776.php.

Recommendation

Update the datatables package to the latest compatible version. Followings are version details:

• Affected version(s): < 1.10.10
• Patched version(s): 1.10.10

References

• GHSA-4mv4-gmmf-q382
• www.netsparker.com
• www.npmjs.com
• www.securityfocus.com
• packetstormsecurity.com
• seclists.org
• CVE-2015-6584
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• @mattkrick/sanitize-svg vulnerable to Cross-Site Scripting (XSS) - CVE-2023-22461
• Materialize-css vulnerable to Cross-site Scripting in autocomplete component - materialize-css - CVE-2019-11003
• Materialize-css vulnerable to Cross-site Scripting in tooltip component - CVE-2019-11002
• Materialize-css vulnerable to Cross-site Scripting in tooltip component - materialize-css - CVE-2019-11002

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

datatables