CVE-2021-41184 — 脆弱性インテリジェンス

jqueryui — jquery ui

公表日: 2021-10-26T00:00:00.000Z

CVSS

6.5

CISA KEV

未掲載（悪用がないことを意味しません）

情報源の原文（翻訳ではありません）

jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the `of` option of the `.position()` util from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. Any string value passed to the `of` option is now treated as a CSS selector. A workaround is to not accept the value of the `of` option from untrusted sources.

情報源

• CVE-2021-41184
• Release Notes, Vendor Advisory
• Patch, Vendor Advisory
• Mitigation, Patch, Vendor Advisory
• Original advisory
• Mailing List, Third Party Advisory
• Mailing List, Third Party Advisory
• Mailing List, Third Party Advisory
• Mailing List, Third Party Advisory
• Mailing List, Third Party Advisory
• Third Party Advisory
• Third Party Advisory
• Patch, Third Party Advisory
• Third Party Advisory
• Patch, Release Notes, Third Party Advisory
• CVE-2021-41184