CVE-2021-41183 Information

Description

jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0 accepting the value of various Text options of the Datepicker widget from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. The values passed to various Text options are now always treated as pure text not HTML. A workaround is to not accept the value of the Text options from untrusted sources.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Reference

https://bugs.jqueryui.com/ticket/15284 https://github.com/jquery/jquery-ui/pull/1953 https://github.com/jquery/jquery-ui/security/advisories/GHSA-j7qv-pgf6-hvh4 https://blog.jqueryui.com/2021/10/jquery-ui-1-13-0-released/ https://security.netapp.com/advisory/ntap-20211118-0004/ https://lists.fedoraproject.org/archives/list/[email protected]/message/O74SXYY7RGXREQDQUDQD4BPJ4QQTD2XQ/ https://lists.fedoraproject.org/archives/list/[email protected]/message/SNXA7XRKGINWSUIPIZ6ZBCTV6N3KSHES/ https://lists.fedoraproject.org/archives/list/[email protected]/message/NXIUUBRVLA4E7G7MMIKCEN75YN7UFERW/ https://www.drupal.org/sa-contrib-2022-004 https://www.drupal.org/sa-core-2022-001 https://www.drupal.org/sa-core-2022-002 https://lists.debian.org/debian-lts-announce/2022/01/msg00014.html https://www.oracle.com/security-alerts/cpuapr2022.html https://www.tenable.com/security/tns-2022-09

Attack Complexity

LOW

Privileges Required

NONE

User Interaction Required

NONE

Scope

REQUIRED

Confidentiality Impact

CHANGED

Integrity Impact

LOW

Availability Impact

LOW

Base Score

NONE

Base Severity

6.1