| Package | Affected versions | Patched versions |
|---|---|---|
| org.webjars.npm:jquery-ui | < 1.13.0 | 1.13.0 |
| jQuery.UI.Combined | < 1.13.0 | 1.13.0 |
| jquery-ui-rails | < 7.0.0 | 7.0.0 |
| drupal | ≥ 7.0, < 7.86≥ 9.2.0, < 9.2.11≥ 9.3.0, < 9.3.3 | 7.869.2.119.3.3 |
| jquery ui | < 1.13.0 | 1.13.0 |
| agile product lifecycle management | = 9.3.6 | |
| application express | < 22.1.1 | 22.1.1 |
| banking platform | = 2.12.0= 2.9.0 | |
| big data spatial and graph | = 23.1< 23.1 | 23.1 |
| communications interactive session recorder | = 6.4 | |
| communications operations monitor | = 4.3= 4.4= 5.0 | |
| hospitality inventory management | = 9.1.0 | |
| hospitality materials control | = 18.1 | |
| hospitality suite8 | = 8.10.2≥ 8.11.0, ≤ 8.14.0 | |
| jd edwards enterpriseone tools | ≤ 9.2.6.3 | |
| peoplesoft enterprise peopletools | = 8.58= 8.59 | |
| policy automation | ≥ 12.2.0, ≤ 12.2.25 | |
| primavera unifier | = 18.8= 19.12= 20.12= 21.12≥ 17.7, ≤ 17.12 | |
| rest data services | = 22.1.1< 22.1.1 | 22.1.1 |
| weblogic server | = 12.2.1.3.0= 12.2.1.4.0= 14.1.1.0.0 | |
| tenable.sc | < 5.21.0 | 5.21.0 |
| jquery-ui | < 1.13.0 | 1.13.0 |
Accepting the value of the of option of the .position() util from untrusted sources may execute untrusted code. For example, invoking the following code:
$( "#element" ).position( {
my: "left top",
at: "right bottom",
of: "<img onerror='doEvilThing()' src='/404' />",
collision: "none"
} );
will call the doEvilThing() function.
The issue is fixed in jQuery UI 1.13.0. Any string value passed to the of option is now treated as a CSS selector.
A workaround is to not accept the value of the of option from untrusted sources.
If you have any questions or comments about this advisory, search for a relevant issue in the jQuery UI repo. If you don't find an answer, open a new issue.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free