jquery-1.11.2.min.js: 4 vulnerabilities (highest severity is: 5.7) [main]

[mend-developer-platform-dev]

📂 Vulnerable Library - jquery-1.11.2.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.11.2/jquery.min.js

Path to vulnerable library: /app/src/main/webapp/resources/js/jquery-1.11.2.min.js

Findings

Finding	Severity	🎯 CVSS	Exploit Maturity	EPSS	Library	Type	Fixed in	Remediation Available	Reachability
CVE-2020-11022	🟠 Medium	5.7	Proof of concept	30.1%	jquery-1.11.2.min.js	Direct	org.webjars.npm:jquery:3.5.0,jquery - 3.5.0,jquery - 3.5.0,jquery-rails - 4.4.0,jquery - 3.5.0,org.webjars.npm:jquery:3.5.0,jquery - 3.5.0,jquery-rails - 4.4.0	❌
CVE-2020-11023	🟠 Medium	5.7	Proof of concept	27.8%	jquery-1.11.2.min.js	Direct	org.webjars.npm:jquery:3.5.0,jquery - 3.5.0,jquery-rails - 4.4.0,jQuery - 3.5.0,jquery - 3.5.0,jquery-rails - 4.4.0,org.webjars.npm:jquery:3.5.0,jQuery - 3.5.0	❌
CVE-2015-9251	🟠 Medium	5.3	High	10.1%	jquery-1.11.2.min.js	Direct	jquery - 3.0.0,org.webjars.npm:jquery:1.12.2,jQuery - 3.0.0,jquery-rails - 4.2.0,jquery - 1.12.2,org.webjars.npm:jquery:3.0.0,jQuery - 1.12.2,jQuery - 3.0.0,org.webjars.npm:jquery:1.12.2,org.webjars.npm:jquery:3.0.0,jquery - 3.0.0,jquery - 1.12.2,jQuery - 1.12.2,jquery-rails - 4.2.0	❌
CVE-2019-11358	🟡 Low	2.1	Proof of concept	5.5%	jquery-1.11.2.min.js	Direct	org.webjars.npm:jquery:3.4.0,django - 2.2.2,jquery - 3.4.0,jquery-rails - 4.3.4,django - 2.1.9,jQuery - 3.4.0,jquery-rails - 4.3.4,django - 2.2.2,django - 2.1.9,org.webjars.npm:jquery:3.4.0,jQuery - 3.4.0,jquery - 3.4.0	❌

Details

🟠CVE-2020-11022

Vulnerable Library - jquery-1.11.2.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.11.2/jquery.min.js

Path to vulnerable library: /app/src/main/webapp/resources/js/jquery-1.11.2.min.js

Dependency Hierarchy:

• ❌ jquery-1.11.2.min.js (Vulnerable Library)

---

Vulnerability Details

In jQuery versions greater than or equal to 1.2 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.

Publish Date: Apr 29, 2020 12:00 AM

URL: CVE-2020-11022

Threat Assessment

Exploit Maturity:Proof of concept

EPSS:30.1%

Score: 5.7

---

Suggested Fix

Type: Upgrade version

Origin: GHSA-gxr4-xjj5-5px2

Release Date: Apr 29, 2020 12:00 AM

Fix Resolution : org.webjars.npm:jquery:3.5.0,jquery - 3.5.0,jquery - 3.5.0,jquery-rails - 4.4.0,jquery - 3.5.0,org.webjars.npm:jquery:3.5.0,jquery - 3.5.0,jquery-rails - 4.4.0

🟠CVE-2020-11023

Vulnerable Library - jquery-1.11.2.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.11.2/jquery.min.js

Path to vulnerable library: /app/src/main/webapp/resources/js/jquery-1.11.2.min.js

Dependency Hierarchy:

• ❌ jquery-1.11.2.min.js (Vulnerable Library)

---

Vulnerability Details

In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.

Publish Date: Apr 29, 2020 12:00 AM

URL: CVE-2020-11023

Threat Assessment

Exploit Maturity:Proof of concept

EPSS:27.8%

Score: 5.7

---

Suggested Fix

Type: Upgrade version

Origin: GHSA-jpcq-cgw6-v4j6

Release Date: Apr 29, 2020 12:00 AM

Fix Resolution : org.webjars.npm:jquery:3.5.0,jquery - 3.5.0,jquery-rails - 4.4.0,jQuery - 3.5.0,jquery - 3.5.0,jquery-rails - 4.4.0,org.webjars.npm:jquery:3.5.0,jQuery - 3.5.0

🟠CVE-2015-9251

Vulnerable Library - jquery-1.11.2.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.11.2/jquery.min.js

Path to vulnerable library: /app/src/main/webapp/resources/js/jquery-1.11.2.min.js

Dependency Hierarchy:

• ❌ jquery-1.11.2.min.js (Vulnerable Library)

---

Vulnerability Details

jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed.

Publish Date: Jan 18, 2018 11:00 PM

URL: CVE-2015-9251

Threat Assessment

Exploit Maturity:High

EPSS:10.1%

Score: 5.3

---

Suggested Fix

Type: Upgrade version

Origin: GHSA-rmxg-73gg-4p98

Release Date: Jan 18, 2018 11:00 PM

Fix Resolution : jquery - 3.0.0,org.webjars.npm:jquery:1.12.2,jQuery - 3.0.0,jquery-rails - 4.2.0,jquery - 1.12.2,org.webjars.npm:jquery:3.0.0,jQuery - 1.12.2,jQuery - 3.0.0,org.webjars.npm:jquery:1.12.2,org.webjars.npm:jquery:3.0.0,jquery - 3.0.0,jquery - 1.12.2,jQuery - 1.12.2,jquery-rails - 4.2.0

🟡CVE-2019-11358

Vulnerable Library - jquery-1.11.2.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.11.2/jquery.min.js

Path to vulnerable library: /app/src/main/webapp/resources/js/jquery-1.11.2.min.js

Dependency Hierarchy:

• ❌ jquery-1.11.2.min.js (Vulnerable Library)

---

Vulnerability Details

jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable proto property, it could extend the native Object.prototype.
Mend Note: The description of this vulnerability differs from MITRE.

Publish Date: Apr 19, 2019 12:00 AM

URL: CVE-2019-11358

Threat Assessment

Exploit Maturity:Proof of concept

EPSS:5.5%

Score: 2.1

---

Suggested Fix

Type: Upgrade version

Origin: GHSA-6c3j-c64m-qhgq

Release Date: Apr 19, 2019 12:00 AM

Fix Resolution : org.webjars.npm:jquery:3.4.0,django - 2.2.2,jquery - 3.4.0,jquery-rails - 4.3.4,django - 2.1.9,jQuery - 3.4.0,jquery-rails - 4.3.4,django - 2.2.2,django - 2.1.9,org.webjars.npm:jquery:3.4.0,jQuery - 3.4.0,jquery - 3.4.0