Description
In jQuery starting with 1.12.0 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.
Affected products
jquery: jquery; drupal: drupal; debian: debian linux; fedoraproject: fedora; oracle: agile product lifecycle management for process; oracle: application testing suite; oracle: banking digital experience; oracle: blockchain platform; oracle: communications application session controller; oracle: communications billing and revenue management; oracle: communications diameter signaling router idih\; oracle: communications eagle application processor; oracle: communications services gatekeeper; oracle: communications webrtc session controller; oracle: enterprise manager ops center
References10
- blog.jquery.com/2020/04/10/jquery-3-5-0-released/ Release NotesVendor Advisory
- jquery.com/upgrade-guide/3.5/ MitigationVendor Advisory
- github.com/jquery/jquery/commit/1d61fd9407e6fbe82fe55cb0b938307… PatchThird Party Advisory
- www.oracle.com/security-alerts/cpuApr2021.html PatchThird Party Advisory
- www.oracle.com/security-alerts/cpuapr2022.html PatchThird Party Advisory
- www.oracle.com/security-alerts/cpujan2022.html PatchThird Party Advisory
- www.oracle.com/security-alerts/cpuoct2021.html PatchThird Party Advisory
- github.com/jquery/jquery/commit/1d61fd9407e6fbe82fe55cb0b938307… PatchThird Party Advisory
- www.oracle.com//security-alerts/cpujul2021.html PatchThird Party Advisory
- www.oracle.com/security-alerts/cpuApr2021.html PatchThird Party Advisory
Metrics
- CVSS 3.1
-
6.1
MEDIUM
Score source: NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - CWE
- CWE-79