BIT-drupal-2021-41184: Medium severity jQuery jQuery UI vulnerability

Q: What must an attacker be able to control to exploit this issue?

An attacker must be able to supply an untrusted value for the of option passed to the jQuery UI .position() utility. Exploitation also requires a user to interact with the affected application.

Q: Which deployments are affected?

Deployments using jQuery UI versions before 1.13.0 are affected when they pass untrusted input to the .position() utility's of option. The provided data does not establish that a default configuration is vulnerable without that untrusted input path.

Q: What can be done if upgrading is not immediately possible?

Do not accept or pass untrusted values into the of option of .position(). Restrict that option to application-controlled values until jQuery UI can be updated to version 1.13.0 or later.

Published Oct 26, 2021

Updated

jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the of option of the .position() util from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. Any string value passed to the of option is now treated as a CSS selector. A workaround is to not accept the value of the of option from untrusted sources.

Affected Software

1 affected component

jQuery jQuery UI<1.13.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade jQuery UI to a version that resolves this vulnerability.
Fixed in 1.13.0
Compensating control
Do not accept the value of the `of` option of the `.position()` utility from untrusted sources.

Event History

Oct 26, 2021

CVE Published

via OSV·03:15 PM

Data Sourced

via OSV·03:15 PM

DescriptionSeverity

Frequently Asked Questions

What must an attacker be able to control to exploit this issue?

An attacker must be able to supply an untrusted value for the of option passed to the jQuery UI .position() utility. Exploitation also requires a user to interact with the affected application.

Which deployments are affected?

Deployments using jQuery UI versions before 1.13.0 are affected when they pass untrusted input to the .position() utility's of option. The provided data does not establish that a default configuration is vulnerable without that untrusted input path.

What can be done if upgrading is not immediately possible?

Do not accept or pass untrusted values into the of option of .position(). Restrict that option to application-controlled values until jQuery UI can be updated to version 1.13.0 or later.

BIT-drupal-2021-41184: Medium severity jQuery jQuery UI vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

What must an attacker be able to control to exploit this issue?

Which deployments are affected?

What can be done if upgrading is not immediately possible?

Company

Resources

Contact

Frequently Asked Questions

What must an attacker be able to control to exploit this issue?

Which deployments are affected?

What can be done if upgrading is not immediately possible?