select2 XSS issue with current version | ww.wp.xz.cn

Resolved Dewey Bushaw
(@styledev)

2 years, 1 month ago

In Select2 through version 4.0.8, as used in Snipe-IT and other products, rich selectlists allow XSS. This affects use cases with Ajax remote data loading when HTML templates are used to display listbox data. For more info see https://security.snyk.io/vuln/SNYK-JS-SELECT2-456562

Please consider patching this asap to the latest version 4.0.13

Viewing 5 replies - 1 through 5 (of 5 total)

chegor
(@chegor)

1 year, 12 months ago

Any updates on this?

Piotr Delawski
(@delawski)

1 year, 10 months ago

Thank you for reporting this @styledev and @chegor. Select2 has been updated to the latest version in Stream 4.0.1 released today.

Nazar Tikhoniuk
(@nazartikhonyuk)

1 year, 7 months ago

Still appears to be an issue – plugin version 4.0.2

Info: In Select2 through 4.0.5, as used in Snipe-IT and other products, rich selectlists allow XSS. This affects use cases with Ajax remote data loading when HTML templates are used to display listbox data.

File: /wp-content/plugins/stream/ui/lib/select2/js/select2.min.js
Marco Pereirinha
(@pereirinha)

1 year, 7 months ago
Hi @nazartikhonyuk

Thank you for your update. After evaluating, here are the findings:
- As of Stream 4.0.1, including the most recent 4.0.2, has Select2 updated to the latest 4.0.13;
- Select2 4.0.13 has no known direct vulnerabilities;
Can you please confirm these points on your end?

Thank you once again.
Nazar Tikhoniuk
(@nazartikhonyuk)

1 year, 6 months ago

Hi @pereirinha

This is fixed.

Thank you!

Viewing 5 replies - 1 through 5 (of 5 total)

The topic ‘select2 XSS issue with current version’ is closed to new replies.

8 replies
5 participants
Last reply from: Nazar Tikhoniuk
Last activity: 1 year, 6 months ago
Status: resolved