What is GHSA-7c82-mp33-r854?

GHSA-7c82-mp33-r854 is a security advisory published by GitHub Security Advisories with Medium severity. Cross-site scripting in bootstrap-select

Which CVE IDs does GHSA-7c82-mp33-r854 cover?

GHSA-7c82-mp33-r854 covers the following CVE IDs: CVE-2019-20921. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-7c82-mp33-r854?

GHSA-7c82-mp33-r854 has a CVSS v3 base score of 6.1, published by GitHub Security Advisories.

Which products are affected by GHSA-7c82-mp33-r854?

GHSA-7c82-mp33-r854 affects 2 products, including: npm/bootstrap-select:\u003c 1.13.6; nuget/bootstrap-select:\u003c 1.13.6.

GHSA-7c82-mp33-r854MediumCVSS 6.1

Cross-site scripting in bootstrap-select

Vendor

GitHub Security Advisories

Published

May 7, 2021

Last Modified

November 25, 2024

🔗 CVE IDs covered (1)

CVE-2019-20921 →

📋 Description

bootstrap-select before 1.13.6 allows Cross-Site Scripting (XSS). It does not escape title values in OPTION elements. This may allow attackers to execute arbitrary JavaScript in a victim's browser.

🎯 Affected products2

npm/bootstrap-select:< 1.13.6
nuget/bootstrap-select:< 1.13.6

🔗 References (6)

https://nvd.nist.gov/vuln/detail/CVE-2019-20921
https://github.com/snapappointments/bootstrap-select/issues/2199
https://github.com/snapappointments/bootstrap-select/commit/ab6e068748040cf3cda5859f6349b382402b8767
https://snyk.io/vuln/SNYK-JS-BOOTSTRAPSELECT-570457
https://issues.jtl-software.de/issues/SHOP-7964
https://github.com/advisories/GHSA-7c82-mp33-r854