XSS in React-Bootstrap-Table Project
CVE-2021-23398
All versions of package react-bootstrap-table are vulnerable to Cross-site Scripting (XSS) via the dataFormat parameter. The problem is triggered when an invalid React element is returned, leading to dangerouslySetInnerHTML being used, which does not sanitize the output.
Vulnerability class: XSS (Cross-Site Scripting)
EPSS: 0.013 (68.9th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.1 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N.
Affected products
- React-bootstrap-table_project React-bootstrap-table
- N/a React-bootstrap-table — versions 0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- report@snyk.io (Exploit, Third Party Advisory, x_refsource_MISC)
- report@snyk.io (Exploit, Third Party Advisory, x_refsource_MISC)
- report@snyk.io (x_refsource_MISC, Broken Link)
- report@snyk.io (Exploit, Third Party Advisory, x_refsource_MISC)
Frequently asked questions
- What is CVE-2021-23398?
- CVE-2021-23398 is a medium-severity vulnerability in React-Bootstrap-Table Project, classified under Cross-site Scripting. CVSS score: 6.1/10. Published 2021-06-24.
- How severe is CVE-2021-23398?
- Medium severity. CVSS v3 base score is 6.1 out of 10.
- Is CVE-2021-23398 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.