cperl icon indicating copy to clipboard operation
cperl copied to clipboard

Published 20 hours ago • verified publisher icon perl11

CVE-2020-11023 (Medium) detected in jquery-3.4.1.min.js

Open mend-bolt-for-github[bot] opened this issue 5 years ago • 0 comments

CVE-2020-11023 - Medium Severity Vulnerability

Vulnerable Library - jquery-3.4.1.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/3.4.1/jquery.min.js

Path to vulnerable library: /cpan/Devel-NYTProf/lib/Devel/NYTProf/js/jquery-min.js

Dependency Hierarchy:

  • :x: jquery-3.4.1.min.js (Vulnerable Library)

Found in HEAD commit: b75e4ca88399da010aebfafef7fd4cb4cb97aff9

Vulnerability Details

In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing

Publish Date: 2020-04-29

URL: CVE-2020-11023

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None
For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://github.com/jquery/jquery/security/advisories/GHSA-jpcq-cgw6-v4j6,https://github.com/rails/jquery-rails/blob/master/CHANGELOG.md#440

Release Date: 2020-04-29

Fix Resolution: jquery - 3.5.0;jquery-rails - 4.4.0

Step up your Open Source Security Game with Mend here

mend-bolt-for-github[bot] avatar Aug 10 '20 11:08 mend-bolt-for-github[bot]