Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

update js libraries to avoid vulnerabilities #1010

Closed
stoicflame opened this issue Feb 14, 2020 · 1 comment
Closed

update js libraries to avoid vulnerabilities #1010

stoicflame opened this issue Feb 14, 2020 · 1 comment
Labels
Milestone

Comments

@stoicflame
Copy link
Owner

Vulnerable javascript library: Bootstrap version: 3.3.4 script uri: https://maxcdn.bootstrapcdn.com/bootstrap/3.3.4/js/bootstrap.min.js

Details: The data-target attribute in bootstrap versions below 3.4.0 is vulnerable to Cross-Site Scripting(XSS) attacks. Please refer to vendor documentation (twbs/bootstrap#23687, twbs/bootstrap#20184) for the latest security updates.

Vulnerable javascript library: jQuery version: 1.11.2 script uri: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.11.2/jquery.min.js

Details: CVE-2015-9251: jQuery versions on or above 1.4.0 and below 1.12.0 (version 1.12.3 and above but below 3.0.0-beta1 as well) are vulnerable to XSS via 3rd party text/javascript responses(3rd party CORS request may execute). (jquery/jquery#2432). Solution: jQuery version 1.12.0 has been released to address the issue (http://blog.jquery.com/2016/01/08/jquery-2-2-and-1-12-released/). NOTE: Fix was reverted back in 1.12.2, so version 1.12.3 and above but below 3.0.0-beta1 are vulnerable as well. Please refer to vendor documentation (https://blog.jquery.com/) for the latest security updates.

@stoicflame stoicflame added the bug label Feb 14, 2020
@stoicflame stoicflame added this to the 2.13.0 milestone Feb 14, 2020
@stoicflame
Copy link
Owner Author

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

No branches or pull requests

1 participant