JQuery 1.x < 1.12.0 / 2.x < 2.2.0 XSS

medium Nessus Plugin ID 106657

Language:

Synopsis

The remote web server is affected by a cross site scripting vulnerability.

Description

The version of JQuery library hosted on the remote web server is 1.x prior to 1.12.0 or 2.x prior to 2.2.0. It is, therefore, affected by a cross site scripting vulnerability when using location.host to select elements.

Solution

Upgrade to JQuery version 1.12.0 or later.

Plugin Details

Severity: Medium

ID: 106657

File Name: jquery_2_2_0.nasl

Version: 1.6

Type: remote

Family: CGI abuses : XSS

Published: 2/7/2018

Updated: 11/24/2020

Configuration: Enable paranoid mode

Supported Sensors: Nessus

Risk Information

CVSS Score Rationale: Score based on analysis of the vendor advisory.

CVSS v2

Risk Factor: Medium

Base Score: 4.3

Temporal Score: 3.7

Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS Score Source: manual

CVSS v3

Risk Factor: Medium

Base Score: 4.7

Temporal Score: 4.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N

Temporal Vector: CVSS:3.0/E:H/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:jquery:jquery

Required KB Items: Settings/ParanoidReport, installed_sw/jquery

Exploit Ease: No exploit is required

Patch Publication Date: 9/10/2015

Vulnerability Publication Date: 6/15/2015

Detections

Analytics