{
"id": "GHSA-7c82-mp33-r854",
"aliases": [
"CVE-2019-20921"
],
"details": "bootstrap-select before 1.13.6 allows Cross-Site Scripting (XSS). It does not escape title values in OPTION elements. This may allow attackers to execute arbitrary JavaScript in a victim's browser.",
"summary": "Cross-site scripting in bootstrap-select",
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.13.6"
}
]
}
],
"package": {
"name": "bootstrap-select",
"ecosystem": "npm"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.13.6"
}
]
}
],
"package": {
"name": "bootstrap-select",
"ecosystem": "NuGet"
}
}
],
"modified": "2024-11-25T19:25:41Z",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N"
}
],
"published": "2021-05-07T16:47:54Z",
"references": [
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-20921",
"type": "ADVISORY"
},
{
"url": "https://github.com/snapappointments/bootstrap-select/issues/2199",
"type": "WEB"
},
{
"url": "https://github.com/snapappointments/bootstrap-select/commit/ab6e068748040cf3cda5859f6349b382402b8767",
"type": "WEB"
},
{
"url": "https://github.com/snapappointments/bootstrap-select",
"type": "PACKAGE"
},
{
"url": "https://issues.jtl-software.de/issues/SHOP-7964",
"type": "WEB"
},
{
"url": "https://snyk.io/vuln/SNYK-JS-BOOTSTRAPSELECT-570457",
"type": "WEB"
}
],
"schema_version": "1.4.0",
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": "MODERATE",
"github_reviewed": true,
"nvd_published_at": "2020-09-30T18:15:00Z",
"github_reviewed_at": "2021-04-22T23:22:11Z"
}
}