Use of insecure jQuery version in OctoberCMS

中GHSA-v73w-r9xg-7cr9 · 05/06/2020 公開 · 02/12/2024 更新

要点

GHSA-v73w-r9xg-7cr9 は october/october, october/system に影響する深刻度「中」の脆弱性です。
対処：1.0.466 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
october/october Packagist	`≥ 1.0.319, < 1.0.466`	`1.0.466`
october/system Packagist	`≥ 1.0.319, < 1.0.466`	`1.0.466`

概要

Impact

Passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code.

Patches

Issue has been patched in Build 466 (v1.0.466) by applying the recommended patch from @jquery.

Workarounds

Apply https://github.com/octobercms/october/commit/5c7ba9fbe9f2b596b2f0e3436ee06b91b97e5892 to your installation manually if unable to upgrade to Build 466.

References

For more information

If you have any questions or comments about this advisory:

Email us at [email protected] & [email protected]

Threat Assessment

Assessed as Moderate by the @jquery team.

Acknowledgements

Thanks to @mrgswift for reporting the issue to the October CMS team.

参考情報

octobercms/october security advisory · WEB
octobercms/october · WEB
octobercms/october commit 5c7ba9f · WEB
octobercms/october · PACKAGE

october/october のその他の脆弱性

すべて見る →

これらの製品をお使いですか？サイトをスキャンして、脆弱なバージョンが公開されていないか確認しましょう。

無料でサイトをスキャン

パッケージ

影響を受けるバージョン

修正済みバージョン

october/october

Packagist

≥ 1.0.319, < 1.0.466

1.0.466

october/system

Packagist

≥ 1.0.319, < 1.0.466

1.0.466

概要

Impact

Passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code.

Patches

Issue has been patched in Build 466 (v1.0.466) by applying the recommended patch from @jquery.

Workarounds

Apply https://github.com/octobercms/october/commit/5c7ba9fbe9f2b596b2f0e3436ee06b91b97e5892 to your installation manually if unable to upgrade to Build 466.

References

For more information

If you have any questions or comments about this advisory:

Email us at [email protected] & [email protected]

Threat Assessment

Assessed as Moderate by the @jquery team.

Acknowledgements

Thanks to @mrgswift for reporting the issue to the October CMS team.

october/october のその他の脆弱性

すべて見る →