DataTable Vulnerable to Cross-Site Scripting

MITTEL 4.3CVE-2015-6584 · GHSA-4mv4-gmmf-q382 · Published 11/09/2015 · updated 17/06/2026

Kurz gesagt

CVE-2015-6584 ist eine Schwachstelle (MITTEL (CVSS 4.3)) in datatables/datatables, datatables (sprymedia), datatables.
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 2.7%, höher als bei 85.9% aller Schwachstellen.
Abhilfe: auf 1.10.10 oder neuer aktualisieren.

Package	Affected versions	Patched versions
datatables/datatables Packagist	`< 1.10.10`	`1.10.10`
datatables sprymedia	`≤ 1.10.8`	No fix yet
datatables npm	`< 1.10.10`	`1.10.10`

Description

Cross-site scripting (XSS) vulnerability in the DataTables plugin 1.10.8 and earlier for jQuery allows remote attackers to inject arbitrary web script or HTML via the scripts parameter to media/unit_testing/templates/6776.php.

Recommendation

Update to a version greater than 1.10.8. A fix appears in version 1.10.10.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2015-6584 · ADVISORY
DataTables/DataTables · WEB
DataTables/DataTablesSrc commit ccf86dc · WEB
DataTables/DataTables · PACKAGE
DataTables/DataTablesSrc · WEB
netsparker.com/cve-2015-6384-xss-vulnerability-identified-in-datatables · WEB
npmjs.com/advisories/5 · WEB
packetstormsecurity.com/files/133555/DataTables-1.10.8-Cross-Site-Scripting.html · WEB
seclists.org/fulldisclosure/2015/Sep/37 · WEB
securityfocus.com/archive/1/536437/100/0/threaded · WEB
securityfocus.com/archive/1/archive/1/536437/100/0/threaded

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free