CVE-2014-6071: XSS
A cross-site scripting flaw was reported against jQuery 1.4.2:
http://seclists.org/fulldisclosure/2014/Sep/10
The original report notes to upgrade to version 1.11.1, which may include the fix.
Other sources
jQuery 1.4.2 allows remote attackers to conduct cross-site scripting (XSS) attacks via vectors related to use of the text method inside after.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-6071?
CVE-2014-6071 is classified as a cross-site scripting vulnerability which can lead to unauthorized actions on behalf of the user.
How do I fix CVE-2014-6071?
To fix CVE-2014-6071, you should upgrade jQuery to version 1.11.1 or later, which addresses this vulnerability.
Which versions of jQuery are affected by CVE-2014-6071?
CVE-2014-6071 affects jQuery version 1.4.2 and potentially earlier versions.
What type of attacks can exploit CVE-2014-6071?
CVE-2014-6071 can be exploited to perform cross-site scripting attacks, allowing attackers to inject malicious scripts into web pages.
Is there a workaround for CVE-2014-6071?
While the best solution is to upgrade jQuery, implementing proper input validation and output encoding can serve as temporary mitigations against CVE-2014-6071.