F5-K02453220: XSS
Published Aug 3, 2020
·Updated
In jQuery versions greater than or equal to 1.2 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.
Affected Software
4 affected componentsFixes available
F5 BIG-IP>=17.5.0<=17.5.1, >=17.1.0<=17.1.3
17.5.1.417.1.3.1
F5 BIG-IP>=16.1.0<=16.1.6
F5 BIG-IP>=15.1.0<=15.1.10
F5 Traffix SDC=5.2.0
Event History
Aug 3, 2020
Advisory Published
via F5·08:47 AM
Frequently Asked Questions
1
What is the severity of F5-K02453220?
The severity of F5-K02453220 is considered high due to the potential execution of untrusted code.
2
How do I fix F5-K02453220?
To fix F5-K02453220, upgrade your jQuery library to version 3.5.0 or later.
3
Which versions of F5 BIG-IP are affected by F5-K02453220?
F5-K02453220 affects F5 BIG-IP versions 17.5.0 to 17.5.1, 17.1.0 to 17.1.2, 16.1.0 to 16.1.6, and 15.1.0 to 15.1.10.
4
What products are impacted by F5-K02453220?
Affected products include F5 BIG-IP and F5 Traffix SDC version 5.2.0.
5
Is there a patch available for F5-K02453220?
Yes, the vulnerability is patched in jQuery version 3.5.0.