Skip to content
New issue

Have a question about this project? # for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “#”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? # to your account

update js libraries to avoid vulnerabilities #1010

Closed
stoicflame opened this issue Feb 14, 2020 · 1 comment
Closed

update js libraries to avoid vulnerabilities #1010

stoicflame opened this issue Feb 14, 2020 · 1 comment
Labels
Milestone

Comments

@stoicflame
Copy link
Owner

Vulnerable javascript library: Bootstrap version: 3.3.4 script uri: https://maxcdn.bootstrapcdn.com/bootstrap/3.3.4/js/bootstrap.min.js

Details: The data-target attribute in bootstrap versions below 3.4.0 is vulnerable to Cross-Site Scripting(XSS) attacks. Please refer to vendor documentation (twbs/bootstrap#23687, twbs/bootstrap#20184) for the latest security updates.

Vulnerable javascript library: jQuery version: 1.11.2 script uri: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.11.2/jquery.min.js

Details: CVE-2015-9251: jQuery versions on or above 1.4.0 and below 1.12.0 (version 1.12.3 and above but below 3.0.0-beta1 as well) are vulnerable to XSS via 3rd party text/javascript responses(3rd party CORS request may execute). (jquery/jquery#2432). Solution: jQuery version 1.12.0 has been released to address the issue (http://blog.jquery.com/2016/01/08/jquery-2-2-and-1-12-released/). NOTE: Fix was reverted back in 1.12.2, so version 1.12.3 and above but below 3.0.0-beta1 are vulnerable as well. Please refer to vendor documentation (https://blog.jquery.com/) for the latest security updates.

@stoicflame stoicflame added the bug label Feb 14, 2020
@stoicflame stoicflame added this to the 2.13.0 milestone Feb 14, 2020
@stoicflame
Copy link
Owner Author

# for free to join this conversation on GitHub. Already have an account? # to comment
Labels
Projects
None yet
Development

No branches or pull requests

1 participant