CVE-2015-9251
UNKNOWN
Published 2018-01-18T23:00:00
Actions:
Expert Analysis
Professional remediation guidance
Get tailored security recommendations from our analyst team for CVE-2015-9251. We'll provide specific mitigation strategies based on your environment and risk profile.
No CVSS data available
Description
jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed.
Available Exploits
No exploits available for this CVE.
Related News
No news articles found for this CVE.
GitHub Security Advisories
Community-driven vulnerability intelligence from GitHub
Advisory Details
Affected versions of `jquery` interpret `text/javascript` responses from cross-origin ajax requests, and automatically execute the contents in `jQuery.globalEval`, even when the ajax request doesn't contain the `dataType` option.
## Recommendation
Update to version 3.0.0 or later.
Affected Packages
npm
jquery
ECOSYSTEM:
≥0
<1.12.2
NuGet
jQuery
ECOSYSTEM:
≥0
<1.12.2
NuGet
jQuery
ECOSYSTEM:
≥1.12.3
<3.0.0
npm
jquery
ECOSYSTEM:
≥1.12.3
<3.0.0
RubyGems
jquery-rails
ECOSYSTEM:
≥0
<4.2.0
Maven
org.webjars.npm:jquery
ECOSYSTEM:
≥0
<1.12.2
Maven
org.webjars.npm:jquery
ECOSYSTEM:
≥1.12.3
<3.0.0
CVSS Scoring
CVSS Score
5.0
CVSS Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
References
PACKAGE
https://github.com/jquery/jquery
Advisory provided by GitHub Security Advisory Database. Published: January 22, 2018, Modified: September 17, 2021
References
HackerOne Reports
chrisseaton
Ruby
Published: 2018-01-18T23:00:00
Last Modified: 2024-08-06T08:43:41.697Z
Copied to clipboard!