CVE-2021-41184 — Cross-site Scripting in Jquery-ui

CWE-79 — Cross-site Scripting21 documents9 sources

Severity

6.1MEDIUMNVD

CNA6.5

EPSS

25.4%

top 3.78%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Jquery Jquery-ui Drupal Jqueryui Jquery UI +18 more

Timeline

PublishedOct 26

Latest updateApr 15

Description

jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the `of` option of the `.position()` util from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. Any string value passed to the `of` option is now treated as a CSS selector. A workaround is to not accept the value of the `of` option from untrusted sources.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages21 packages

▶CVEListV5jquery/jquery-ui< 1.13.0

▶npmjquery/jquery-ui< 1.13.0

▶NVDjqueryui/jquery_ui< 1.13.0

▶Packagistdrupal/core8.0.0 — 9.2.11+1

▶NVDdrupal/drupal7.0 — 7.86+2

Also affects: Fedora 33, 34, 35, 36

Patches

Patch: github.com ↗Patch: github.com ↗Patch: www.oracle.com ↗

🔴Vulnerability Details

OSV

jqueryui vulnerability↗2022-09-09

▶

OSV

CVE-2021-41184: jQuery UI is a third-party library used by Drupal↗2022-01-19

▶

CVEList

XSS in the `of` option of the `.position()` util↗2021-10-26

▶

OSV

CVE-2021-41184: jQuery-UI is the official jQuery user interface library↗2021-10-26

▶

GHSA

XSS in the `of` option of the `.position()` util in jquery-ui↗2021-10-26

▶

📋Vendor Advisories

Oracle

Oracle Oracle GoldenGate Risk Matrix: Embedded Web UI for Services (jQueryUI) — CVE-2021-41184↗2025-04-15

▶

Oracle

Oracle Oracle Utilities Applications Risk Matrix: General (jQueryUI) — CVE-2021-41184↗2024-10-15

▶

Oracle

Oracle Oracle Communications Risk Matrix: Security (jQueryUI) — CVE-2021-41184↗2024-07-15

▶

Ubuntu

jQuery UI vulnerabilities↗2023-10-05

▶

Oracle

Oracle Oracle Commerce Risk Matrix: Experience Manager (jQueryUI) — CVE-2021-41184↗2023-07-15

▶