medium6.1
CVE-2021-23445
Cross site scripting in datatables.net
Impact
This affects the package datatables.net before 1.11.3. If an array is passed to the HTML escape entities function it would not have its contents escaped.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | datatables.net | < 1.11.3 | 1.11.3 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Datatables | Datatables.Net | before 1.11.3 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://cdn.datatables.net/1.11.3/
- https://github.com/DataTables/Dist-DataTables/commit/59a8d3f8a3c1138ab08704e783bc52bfe88d7c9b
- https://lists.debian.org/debian-lts-announce/2023/08/msg00018.html
- https://security.netapp.com/advisory/ntap-20240621-0006/
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1715371
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1715376
- https://snyk.io/vuln/SNYK-JS-DATATABLESNET-1540544
- https://github.com/advisories/GHSA-h73q-5wmj-q8pj
- https://nvd.nist.gov/vuln/detail/CVE-2021-23445
- https://cdn.datatables.net/1.11.3
- https://security.netapp.com/advisory/ntap-20240621-0006