GHSA-4mv4-gmmf-q382

Source

https://github.com/advisories/GHSA-4mv4-gmmf-q382

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/08/GHSA-4mv4-gmmf-q382/GHSA-4mv4-gmmf-q382.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-4mv4-gmmf-q382

Aliases

CVE-2015-6584

Published

2020-08-31T22:42:29Z

Modified

2024-12-03T06:08:04Z

Summary

DataTable Vulnerable to Cross-Site Scripting

Details

Cross-site scripting (XSS) vulnerability in the DataTables plugin 1.10.8 and earlier for jQuery allows remote attackers to inject arbitrary web script or HTML via the scripts parameter to media/unit_testing/templates/6776.php.

Recommendation

Update to a version greater than 1.10.8. A fix appears in version 1.10.10.

Database specific

{
    "cwe_ids":  [
        "CWE-79"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2020-08-31T18:07:30Z",
    "nvd_published_at":  null,
    "severity":  "HIGH"
}

References

Affected packages

npm / datatables

Package

Name: datatables; View open source insights on deps.dev
Purl: pkg:npm/datatables

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.10.10

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/08/GHSA-4mv4-gmmf-q382/GHSA-4mv4-gmmf-q382.json"

Packagist / datatables/datatables

Package

Name: datatables/datatables
Purl: pkg:composer/datatables/datatables

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.10.10

Affected versions

1.*

1.10.0-beta.1

1.10.0-beta.2

1.10.0-rc.1

1.10.0

1.10.1

1.10.2

1.10.3

1.10.4

1.10.5

1.10.6

1.10.7

1.10.8

1.10.9

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/08/GHSA-4mv4-gmmf-q382/GHSA-4mv4-gmmf-q382.json"