Cross-site scripting in DataTables - CVE-2021-23445

Vulnerability identifier: #VU60621

CSH Severity: Low

CVSS v4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]

CVE-ID: CVE-2021-23445

CWE-ID: CWE-79

Exploitation vector: Remote access

Exploit availability: No public exploit available

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

DataTables
Bookdatabase
IBM Cloud Pak System
Storage Scale
User Entity Behavior Analytics
JBoss Enterprise Application Platform
Juniper Secure Analytics (JSA)
Tenable Nessus
QRadar User Behavior Analytics
eap7-jboss-jsf (Red Hat package)
eap7-wildfly-http-client (Red Hat package)
eap7-wildfly-transaction-client (Red Hat package)
eap7-wildfly-discovery (Red Hat package)
eap7-jboss-server-migration (Red Hat package)
eap7-jboss-modules (Red Hat package)
eap7-wildfly-elytron (Red Hat package)
eap7-undertow (Red Hat package)
eap7-xml-security (Red Hat package)
eap7-wss4j (Red Hat package)
eap7-hal-console (Red Hat package)
eap7-apache-cxf (Red Hat package)
eap7-jboss-ejb-client (Red Hat package)
eap7-wildfly (Red Hat package)
eap7-infinispan (Red Hat package)
eap7-jboss-metadata (Red Hat package)
IBM Cognos Analytics

Install updates from vendor's website.

DataTables - update to 1.11.3
Bookdatabase - update to 0.1.6
IBM Cloud Pak System - update to 2.3.5.1
Storage Scale - update to 5.2.3.3
JBoss Enterprise Application Platform - update to 7.4.17
Juniper Secure Analytics (JSA) - update to 7.5.0 UP7 IF04
Tenable Nessus - addressed in versions 10.3.1, 10.5.0
eap7-jboss-jsf (Red Hat package) - addressed in versions api_2.3_spec-3.0.0-8.SP08_redhat_00001.1.el7eap, api_2.3_spec-3.0.0-8.SP08_redhat_00001.1.el8eap, api_2.3_spec-3.0.0-8.SP08_redhat_00001.1.el9eap
eap7-wildfly-http-client (Red Hat package) - addressed in versions 1.1.17-1.Final_redhat_00002.1.el7eap, 1.1.17-1.Final_redhat_00002.1.el8eap, 1.1.17-1.Final_redhat_00002.1.el9eap
eap7-wildfly-transaction-client (Red Hat package) - addressed in versions 1.1.19-1.Final_redhat_00001.1.el7eap, 1.1.19-1.Final_redhat_00001.1.el8eap, 1.1.19-1.Final_redhat_00001.1.el9eap
eap7-wildfly-discovery (Red Hat package) - addressed in versions 1.2.4-1.Final_redhat_00001.1.el7eap, 1.2.4-1.Final_redhat_00001.1.el8eap, 1.2.4-1.Final_redhat_00001.1.el9eap
eap7-jboss-server-migration (Red Hat package) - addressed in versions 1.10.0-36.Final_redhat_00035.1.el7eap, 1.10.0-36.Final_redhat_00035.1.el8eap, 1.10.0-36.Final_redhat_00035.1.el9eap
eap7-jboss-modules (Red Hat package) - addressed in versions 1.12.3-3.Final_redhat_00001.1.el7eap, 1.12.3-3.Final_redhat_00001.1.el8eap, 1.12.3-3.Final_redhat_00001.1.el9eap
eap7-wildfly-elytron (Red Hat package) - addressed in versions 1.15.23-2.Final_redhat_00001.1.el7eap, 1.15.23-2.Final_redhat_00001.1.el8eap, 1.15.23-2.Final_redhat_00001.1.el9eap
eap7-undertow (Red Hat package) - addressed in versions 2.2.32-1.SP1_redhat_00001.1.el7eap, 2.2.32-1.SP1_redhat_00001.1.el8eap, 2.2.32-1.SP1_redhat_00001.1.el9eap
eap7-xml-security (Red Hat package) - addressed in versions 2.3.4-1.redhat_00002.1.el7eap, 2.3.4-1.redhat_00002.1.el8eap, 2.3.4-1.redhat_00002.1.el9eap
eap7-wss4j (Red Hat package) - addressed in versions 2.4.3-1.redhat_00001.1.el7eap, 2.4.3-1.redhat_00001.1.el8eap, 2.4.3-1.redhat_00001.1.el9eap
eap7-hal-console (Red Hat package) - addressed in versions 3.3.22-1.Final_redhat_00001.1.el7eap, 3.3.22-1.Final_redhat_00001.1.el8eap, 3.3.22-1.Final_redhat_00001.1.el9eap
eap7-apache-cxf (Red Hat package) - addressed in versions 3.5.8-1.redhat_00001.1.el7eap, 3.5.8-1.redhat_00001.1.el8eap, 3.5.8-1.redhat_00001.1.el9eap
eap7-jboss-ejb-client (Red Hat package) - addressed in versions 4.0.54-3.Final_redhat_00001.1.el7eap, 4.0.54-3.Final_redhat_00001.1.el8eap, 4.0.54-3.Final_redhat_00001.1.el9eap
QRadar User Behavior Analytics - update to 4.1.8
User Entity Behavior Analytics - update to 5.0.2
eap7-wildfly (Red Hat package) - addressed in versions 7.4.17-2.GA_redhat_00002.1.el7eap, 7.4.17-2.GA_redhat_00002.1.el8eap, 7.4.17-2.GA_redhat_00002.1.el9eap
eap7-infinispan (Red Hat package) - addressed in versions 11.0.19-2.Final_redhat_00001.1.el7eap, 11.0.19-2.Final_redhat_00001.1.el8eap, 11.0.19-2.Final_redhat_00001.1.el9eap
IBM Cognos Analytics - addressed in versions 11.1.7 Fix Pack 8, 11.2.4 FP3, 12.0.2
eap7-jboss-metadata (Red Hat package) - addressed in versions 13.5.0-1.Final_redhat_00001.1.el7eap, 13.5.0-1.Final_redhat_00001.1.el8eap, 13.5.0-1.Final_redhat_00001.1.el9eap

• https://snyk.io/vuln/SNYK-JS-DATATABLESNET-1540544
• https://github.com/DataTables/Dist-DataTables/commit/59a8d3f8a3c1138ab08704e783bc52bfe88d7c9b
• https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1715376
• https://cdn.datatables.net/1.11.3/
• https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1715371

• Cross-site scripting in DataTables
• Cross-site scripting in Bookdatabase extension for TYPO3
• Multiple vulnerabilities in IBM QRadar User Behavior Analytics
• Multiple vulnerabilities in Tenable Nessus
• Multiple vulnerabilities in Tenable Nessus
• Juniper Networks Juniper Secure Analytics update for third-party applications
• Multiple vulnerabilities in IBM Cognos Analytics
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform 7.4
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 7
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8
• Multiple vulnerabilities in IBM User Entity Behavior Analytics
• IBM Storage Scale update for package datatables.net
• Multiple vulnerabilities in IBM Cloud Pak System