GoogleOSV:GHSA-RMXG-73GG-4P98Cross-Site Scripting (XSS) in jquery
6.1 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
4.3 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:N/I:P/A:N
0.007 Low
EPSS
Percentile
79.1%
Affected versions of jquery interpret text/javascript responses from cross-origin ajax requests, and automatically execute the contents in jQuery.globalEval, even when the ajax request doesn’t contain the dataType option.
Recommendation
Update to version 3.0.0 or later.
| CPE | Name | Operator | Version |
|---|---|---|---|
| jquery-rails | eq | 3.0.0 | |
| jquery | eq | 1.11.1 | |
| jquery-rails | eq | 1.0.18 | |
| jquery-rails | eq | 1.0.13 | |
| jquery | eq | 1.8.2 | |
| jquery | eq | 2.1.3 | |
| org.webjars.npm:jquery | eq | 2.1.3 | |
| jquery | eq | 1.4.2 | |
| jquery-rails | eq | 3.1.2 | |
| jquery-rails | eq | 0.2.4 |
References
lists.opensuse.org/opensuse-security-announce/2020-03/msg00041.html
packetstormsecurity.com/files/152787/dotCMS-5.1.1-Vulnerable-Dependencies.html
packetstormsecurity.com/files/153237/RetireJS-CORS-Issue-Script-Execution.html
packetstormsecurity.com/files/156743/OctoberCMS-Insecure-Dependencies.html
seclists.org/fulldisclosure/2019/May/10
seclists.org/fulldisclosure/2019/May/11
seclists.org/fulldisclosure/2019/May/13
www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
access.redhat.com/errata/RHSA-2020:0481
access.redhat.com/errata/RHSA-2020:0729
github.com/jquery/jquery
github.com/jquery/jquery/commit/b078a62013782c7424a4a61a240c23c4c0b42614
github.com/jquery/jquery/commit/f60729f3903d17917dc351f3ac87794de379b0cc
github.com/jquery/jquery/issues/2432
github.com/jquery/jquery/issues/2432#issuecomment-403761229
github.com/jquery/jquery/pull/2588
github.com/jquery/jquery/pull/2588/commits/c254d308a7d3f1eac4d0b42837804cfffcba4bb2
github.com/rails/jquery-rails/blob/master/CHANGELOG.md#420
github.com/rails/jquery-rails/blob/v4.2.0/vendor/assets/javascripts/jquery3.js#L9377
github.com/rails/jquery-rails/releases/tag/v4.2.0
github.com/rubysec/ruby-advisory-db/blob/master/gems/jquery-rails/CVE-2015-9251.yml
ics-cert.us-cert.gov/advisories/ICSA-18-212-04
kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44601
lists.apache.org/thread.html/10f0f3aefd51444d1198c65f44ffdf2d78ca3359423dbc1c168c9731@%3Cdev.flink.apache.org%3E
lists.apache.org/thread.html/17ff53f7999e74fbe3cc0ceb4e1c3b00b180b7c5afec8e978837bc49@%3Cuser.flink.apache.org%3E
lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f@%3Cdev.drill.apache.org%3E
lists.apache.org/thread.html/52bafac05ad174000ea465fe275fd3cc7bd5c25535a7631c0bc9bfb2@%3Cuser.flink.apache.org%3E
lists.apache.org/thread.html/54df3aeb4239b64b50b356f0ca6f986e3c4ca5b84c515dce077c7854@%3Cuser.flink.apache.org%3E
lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442@%3Cdev.drill.apache.org%3E
lists.apache.org/thread.html/ba79cf1658741e9f146e4c59b50aee56656ea95d841d358d006c18b6@%3Ccommits.roller.apache.org%3E
lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc@%3Cissues.drill.apache.org%3E
nvd.nist.gov/vuln/detail/CVE-2015-9251
seclists.org/bugtraq/2019/May/18
security.netapp.com/advisory/ntap-20210108-0004
security.snyk.io/vuln/SNYK-DOTNET-JQUERY-450227
snyk.io/vuln/npm:jquery:20150627
sw.aveva.com/hubfs/assets-2018/pdf/security-bulletin/SecurityBulletin_LFSec126.pdf
web.archive.org/web/20200227030101/www.securityfocus.com/bid/105658
www.oracle.com/security-alerts/cpuapr2020.html
www.oracle.com/security-alerts/cpujan2020.html
www.oracle.com/security-alerts/cpujul2020.html
www.oracle.com/security-alerts/cpuoct2020.html
www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html
www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html
www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
www.tenable.com/security/tns-2019-08
Related
6.1 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
4.3 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:N/I:P/A:N
0.007 Low
EPSS
Percentile
79.1%