JQuery Cross-Site Scripting (XSS) Vulnerability. Đang bị khai thác thực tế: CISA đưa lỗ hổng này vào danh mục Known Exploited Vulnerabilities ngày 23/01/2025. Hãy vá các hệ thống bị ảnh hưởng ngay.
| Gói / sản phẩm | Phiên bản bị ảnh hưởng | Phiên bản đã vá |
|---|---|---|
| org.webjars.npm:jquery | ≥ 1.0.3, < 3.5.0 | 3.5.0 |
| jQuery | ≥ 1.0.3, < 3.5.0 | 3.5.0 |
| components/jquery | ≥ 1.0.3, < 3.5.0 | 3.5.0 |
| jquery-rails | < 4.4.0 | 4.4.0 |
| drupal | ≥ 7.0, < 7.70≥ 8.7.0, < 8.7.14≥ 8.8.0, < 8.8.6 | 7.708.7.148.8.6 |
| jquery | ≥ 1.0.3, < 3.5.0 | 3.5.0 |
| oncommand system manager | ≥ 3.0, ≤ 3.1.3 | |
| application express | < 20.2 |
Passing HTML containing <option> elements from untrusted sources - even after sanitizing them - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code.
This problem is patched in jQuery 3.5.0.
To workaround this issue without upgrading, use DOMPurify with its SAFE_FOR_JQUERY option to sanitize the HTML string before passing it to a jQuery method.
https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/
If you have any questions or comments about this advisory, search for a relevant issue in the jQuery repo. If you don't find an answer, open a new issue.
Bạn đang dùng một trong các sản phẩm này? Quét site để biết có đang lộ phiên bản có lỗ hổng không.
Quét site miễn phí20.2 |
| application testing suite | = 13.3.0.1 |
| banking enterprise collections | ≥ 2.7.0, ≤ 2.8.0 |
| banking platform | ≥ 2.4.0, ≤ 2.10.0 |
| blockchain platform | = 21.1.2< 21.1.2 | 21.1.2 |
| business intelligence | = 5.9.0.0.0 |
| communications analytics | = 12.1.1 |
| communications eagle application processor | ≥ 16.1.0, ≤ 16.4.0 |
| communications element manager | = 8.1.1= 8.2.0= 8.2.1 |
| communications interactive session recorder | ≥ 6.1, ≤ 6.4 |
| communications operations monitor | = 3.4≥ 4.1, ≤ 4.3 |
| communications services gatekeeper | = 7.0 |
| communications session report manager | = 8.1.1= 8.2.0= 8.2.1 |
| communications session route manager | = 8.1.1= 8.2.0= 8.2.1 |
| financial services regulatory reporting for de nederlandsche bank | = 8.0.4 |
| financial services revenue management and billing analytics | = 2.7= 2.8 |
| health sciences inform | = 6.3.0 |
| healthcare translational research | = 3.2.1= 3.3.1= 3.3.2= 3.4.0 |
| hyperion financial reporting | = 11.1.2.4 |
| jd edwards enterpriseone orchestrator | < 9.2.5.0 | 9.2.5.0 |
| jd edwards enterpriseone tools | < 9.2.5.0 | 9.2.5.0 |
| oss support tools | < 2.12.41 | 2.12.41 |
| peoplesoft enterprise human capital management resources | = 9.2 |
| primavera gateway | ≥ 16.2, ≤ 16.2.11≥ 17.12.0, ≤ 17.12.7≥ 18.8.0, ≤ 18.8.9≥ 19.12.0, ≤ 19.12.4 |
| rest data services | = 11.2.0.4= 12.1.0.2= 12.2.0.1= 18c= 19c |
| siebel mobile | ≤ 20.12 |
| storagetek acsls | = 8.5.1 |
| storagetek tape analytics sw tool | = 2.3.1 |
| webcenter sites | = 12.2.1.3.0= 12.2.1.4.0 |
| weblogic server | = 12.1.3.0.0= 12.2.1.3.0= 12.2.1.4.0= 14.1.1.0.0 |
| log correlation engine | < 6.0.9 | 6.0.9 |
| jquery | ≥ 1.0.3, < 3.5.0 | 3.5.0 |