What is the CVSS score of CVE-2021-23472?

CVE-2021-23472 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 2.3%.

Is there a public PoC exploit available for CVE-2021-23472?

Yes, a public proof-of-concept exploit is available for CVE-2021-23472. Prioritise patching immediately. EPSS: 2.3%.

Bootstrap Table CVE-2021-23472

MEDIUM

Access of Resource Using Incompatible Type (Type Confusion) (CWE-843)

2021-11-03 report@snyk.io

Memory Corruption Authentication Bypass Bootstrap Table

6.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

CVE Published

Nov 03, 2021 - 18:15 nvd

MEDIUM 6.1

DescriptionNVD

This affects versions before 1.19.1 of package bootstrap-table. A type confusion vulnerability can lead to a bypass of input sanitization when the input provided to the escapeHTML function is an array (instead of a string) even if the escape attribute is set.

AnalysisAI

This affects versions before 1.19.1 of package bootstrap-table. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

Technical ContextAI

This vulnerability is classified as Access of Resource Using Incompatible Type (Type Confusion) (CWE-843), which allows attackers to execute arbitrary code by exploiting type confusion in the application. This affects versions before 1.19.1 of package bootstrap-table. A type confusion vulnerability can lead to a bypass of input sanitization when the input provided to the escapeHTML function is an array (instead of a string) even if the escape attribute is set. Affected products include: Bootstrap-Table Bootstrap Table. Version information: before 1.19.1.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Enforce strict type checking, use type-safe languages, validate object types before operations.