HIGH

GHSA-49r3-3h96-rwj6

Cross-Site Scripting in ids-enterprise

Quick fix

GHSA-49r3-3h96-rwj6 — ids-enterprise: upgrade to the fixed version with the command below.

npm install ids-enterprise@4.18.2

Details

Versions of `ids-enterprise` prior to 4.18.2 are vulnerable to Cross-Site Scripting (XSS). The `soho-dropdown` component does not properly encode its output and may allow attackers to execute arbitrary JavaScript.

## Recommendation

Upgrade to version 4.18.2 or later

Are you affected?

Enter the version of the package you're using.

Affected packages

npm/ids-enterprise

Introduced in: 0Fixed in: 4.18.2

Fixnpm install ids-enterprise@4.18.2

References

https://github.com/infor-design/enterprise-ng/issues/503[WEB]
https://github.com/infor-design/enterprise/commit/6bd74d8f38c268b22f31e8169316e065e0093362[WEB]
https://www.npmjs.com/advisories/956[WEB]