Executive brief
tableexport.jquery.plugin is a jQuery library used to export HTML tables to various file formats. A cross-site scripting (XSS) vulnerability in the default onCellHtmlData function allows attackers to inject malicious scripts, potentially enabling theft of session cookies and sensitive data transmission to unauthorized servers.
Technical details
The vulnerability is a cross-site scripting (CWE-79) flaw in the onCellHtmlData function that fails to properly sanitize user-supplied input before rendering it in the browser. An attacker with login access can inject malicious JavaScript code that executes in the context of another user's session. The attack requires user interaction (viewing a manipulated table export) and network access to the web application. Successfully exploiting this vulnerability allows an attacker to steal session cookies, access sensitive data from secure sessions, and perform actions on behalf of the victim user. The fix was released in version 1.25.0.
Affected products
- tableexport.jquery.plugin contributors tableexport.jquery.plugin before 1.25.0
Timeline
- 2022-04-10: disclosed
- 2022-04-11: patched: version 1.25.0 released