# Infor ids-enterprise cross-site scripting in soho-dropdown

Source: https://junglewise.ai/threats/infor-ids-enterprise-cross-site-scripting-in-soho-dropdown-f6da1744  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2019-06-13. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

Severity: info · Published 2019-06-13

ids-enterprise is a JavaScript UI library for building enterprise applications. A cross-site scripting vulnerability in the soho-dropdown component allows attackers to inject and execute arbitrary JavaScript code if the component is used with untrusted input. This could enable attackers to steal user credentials, perform unauthorized actions, or redirect users to malicious sites.

Technologies: [ids-enterprise (npm)](https://junglewise.ai/threats/technologies/ids-enterprise). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Informational severity, published 13 June 2019.

**Which products and versions are affected?** ids-enterprise (npm) SEMVER:introduced=0,fixed=4.18.2.

**Is there a fix for This vulnerability?** Yes. ids-enterprise (npm): upgrade to 4.18.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is This vulnerability attacked?** It is attacked over the network, in a software library.

**Am I affected?** Check whether you run ids-enterprise (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- ids-enterprise (npm): upgrade to 4.18.2 or later

  ```sh
  npm install ids-enterprise@4.18.2
  ```


## Technical details

The vulnerability is a stored or reflected cross-site scripting (XSS) flaw (CWE-79) in the soho-dropdown component of ids-enterprise. The component fails to properly encode output, allowing attackers to inject arbitrary JavaScript that will be executed when the dropdown is rendered. The attack vector is network-based and requires the component to be instantiated with attacker-controlled input. No authentication is required if the vulnerable component is exposed in a public-facing interface. Attackers can achieve arbitrary JavaScript execution in the victim's browser, potentially leading to session hijacking, credential theft, or malware injection. The vulnerability was patched in version 4.18.2; users should upgrade immediately.

## Affected products

- Infor ids-enterprise prior to 4.18.2

## Timeline

- 2019-06-13: disclosed
- 2019: patched: Fixed in version 4.18.2

## References

- [https://github.com/infor-design/enterprise-ng/issues/503](https://github.com/infor-design/enterprise-ng/issues/503)
- [https://github.com/infor-design/enterprise/commit/6bd74d8f38c268b22f31e8169316e065e0093362](https://github.com/infor-design/enterprise/commit/6bd74d8f38c268b22f31e8169316e065e0093362)
- [https://www.npmjs.com/advisories/956](https://www.npmjs.com/advisories/956)

## Related threats

- [Infor ids-enterprise Cross-Site Scripting in modal component](https://junglewise.ai/threats/infor-ids-enterprise-cross-site-scripting-in-modal-component-79839be1)
- [IDS ids-enterprise Cross-Site Scripting in soho-autocomplete](https://junglewise.ai/threats/ids-ids-enterprise-cross-site-scripting-in-soho-autocomplete-c9b67b6d)