Описание
In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.
| Релиз | Статус | Примечание |
|---|---|---|
| bionic | DNE | |
| devel | DNE | |
| esm-apps-legacy/xenial | released | 7.44-1ubuntu1~16.04.0+esm3 |
| esm-apps/xenial | released | 7.44-1ubuntu1~16.04.0+esm3 |
| esm-infra-legacy/trusty | released | 7.26-1ubuntu0.1+esm3 |
| esm-infra/focal | DNE | |
| focal | DNE | |
| groovy | DNE | |
| hirsute | DNE | |
| impish | DNE |
Показывать по
| Релиз | Статус | Примечание |
|---|---|---|
| bionic | ignored | end of standard support, was needed |
| devel | DNE | |
| eoan | ignored | end of life |
| esm-infra-legacy/trusty | not-affected | code not present |
| esm-infra-legacy/xenial | not-affected | code not present |
| esm-infra/bionic | released | 3.2.1-1ubuntu0.1~esm1 |
| esm-infra/focal | released | 3.3.1~dfsg-3ubuntu0.1 |
| esm-infra/xenial | not-affected | code not present |
| focal | released | 3.3.1~dfsg-3ubuntu0.1 |
| groovy | DNE |
Показывать по
| Релиз | Статус | Примечание |
|---|---|---|
| devel | not-affected | code not present |
| esm-apps-legacy/xenial | not-affected | jQuery 1.9.1 vendored, pcsd never sanitizes HTML before .html()/.append |
| esm-apps/bionic | not-affected | jQuery 1.9.1 vendored, pcsd never sanitizes HTML before .html()/.append |
| esm-apps/focal | not-affected | jQuery 1.9.1 vendored, pcsd never sanitizes HTML before .html()/.append |
| esm-apps/jammy | not-affected | jQuery 3.6.0 vendored, fixed upstream |
| jammy | not-affected | jQuery 3.6.0 vendored, fixed upstream |
| noble | not-affected | code not present |
| resolute | not-affected | code not present |
| upstream | not-affected | pcsd never sanitizes HTML before .html()/.append |
Показывать по
Ссылки на источники
EPSS
4.3 Medium
CVSS2
6.1 Medium
CVSS3
Связанные уязвимости
In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.
In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.
In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, pa ...
EPSS
4.3 Medium
CVSS2
6.1 Medium
CVSS3