CVE-2021-41182mediumCWE-79

CVE-2021-41182: falha de média gravidade em jquery-ui

XSS in the `altField` option of the Datepicker widget

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar jquery-ui+ Monitorar drupal7

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

25Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6.5epss 39%
jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the `altField` option of the Datepicker widget from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. Any string value passed to the `altField` option is now treated as a CSS selector. A workaround is to not accept the value of the `altField` option from untrusted sources.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Produtos afetados
jquery · jquery-ui
CVEs relacionadas — jquery-ui

No mesmo produto, das mais perigosas para as menos.

CVE-2021-41184MEDIUMXSS in the `of` option of the `.position()` utilEPSS 40.8%CVE-2021-41183MEDIUMXSS in `*Text` options of the Datepicker widgetEPSS 8.5%CVE-2022-31160MEDIUMjQuery UI contains potential XSS vulnerability when refreshing a checkboxradio with an HTML-like initial text labelEPSS 2.7%