GHSA-m2hm-hrr2-6p2qMediumCVSS 6.1
Cross-site Scripting in Bootstrap-3-Typeahead
🔗 CVE IDs covered (1)
📋 Description
Bootstrap-3-Typeahead after version 4.0.2 is vulnerable to a cross-site scripting flaw in the highlighter() function. An attacker could exploit this via user interaction to execute code in the user's browser. This issue was introduced in commit dbd1af5bf and has not been fixed.
🎯 Affected products2
- npm/bootstrap-3-typeahead:> 4.0.2
- composer/bassjobsen/bootstrap-3-typeahead:> 4.0.2
🔗 References (8)
- https://nvd.nist.gov/vuln/detail/CVE-2019-10215
- https://access.redhat.com/errata/RHSA-2019:3771
- https://github.com/bassjobsen/Bootstrap-3-Typeahead
- http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00083.html
- https://github.com/bassjobsen/Bootstrap-3-Typeahead/commit/dbd1af5bfb14592213e3d88f1fa8f726b93f8a1e
- https://access.redhat.com/security/cve/CVE-2019-10215
- https://bugzilla.redhat.com/show_bug.cgi?id=1735506
- https://github.com/advisories/GHSA-m2hm-hrr2-6p2q