CVE-2020-11023 (Medium) detected in jquery-1.9.1.js, jquery-1.8.1.min.js #2007
Comments
|
ℹ️ This issue was automatically closed by WhiteSource because it is a duplicate of an existing issue: #2020 |
mend-bolt-for-github
bot
changed the title
|
ℹ️ This issue was automatically closed by WhiteSource because it is a duplicate of an existing issue: #2020 |
Sorry, friend. As far as this ol' bot can tell, your issue does not properly use one of this repo's available issue templates. Please try again, if you like. (And if I'm confused, please let us know. 😬)
|
|
This issue is potentially a duplicate of one of the following issues:
|
|
👋 Thanks for reporting! |
|
Thank you for your report, the issue you have reported has just been fixed.
|
mend-bolt-for-github
bot
changed the title
|
ℹ️ This issue was automatically re-opened by WhiteSource because the vulnerable library in the specific branch(es) has been detected in the WhiteSource inventory. |
|
This issue is potentially a duplicate of one of the following issues:
|
1 similar comment
|
This issue is potentially a duplicate of one of the following issues:
|
This was referenced Nov 15, 2021
|
This issue is potentially a duplicate of one of the following issues:
|
|
This issue is potentially a duplicate of one of the following issues:
|
1 similar comment
|
This issue is potentially a duplicate of one of the following issues:
|
This was referenced Nov 17, 2021
This was referenced Nov 17, 2021
This was referenced Nov 26, 2021
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
CVE-2020-11023 - Medium Severity Vulnerability
jquery-1.9.1.js
JavaScript library for DOM operations
Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.9.1/jquery.js
Path to dependency file: typescript-tools/node_modules/tinygradient/bower_components/tinycolor/index.html
Path to vulnerable library: /node_modules/tinygradient/bower_components/tinycolor/demo/jquery-1.9.1.js
Dependency Hierarchy:
jquery-1.8.1.min.js
JavaScript library for DOM operations
Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.8.1/jquery.min.js
Path to dependency file: typescript-tools/node_modules/redeyed/examples/browser/index.html
Path to vulnerable library: /node_modules/redeyed/examples/browser/index.html
Dependency Hierarchy:
Found in HEAD commit: 94a055e45bd6419b98a3f6c030632bac663aa978
In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.
Publish Date: 2020-04-29
URL: CVE-2020-11023
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None
For more information on CVSS3 Scores, click here.Type: Upgrade version
Origin: https://github.com/jquery/jquery/security/advisories/GHSA-jpcq-cgw6-v4j6,https://github.com/rails/jquery-rails/blob/master/CHANGELOG.md#440
Release Date: 2020-04-29
Fix Resolution: jquery - 3.5.0;jquery-rails - 4.4.0
Step up your Open Source Security Game with WhiteSource here
The text was updated successfully, but these errors were encountered: