jQuery UI – CVE-2021-41183

Description

Kayran has detected that the version of jQuery UI being used is vulnerable to cross-site scripting.
This can be done by abusing the ” *Text” options.

By accepting the value of the ” *Text” option of the Datepicker widget from untrusted sources, untrusted codes may be executed. Also known as CVE-2021-41183.

An attacker could abuse this to insert and execute commands for his own purposes.

Recommendation

To fix CVE-2021-41183, update the jQuery UI version being used to 1.13.0 or higher.
As of now, any string value passed to the ” *Text” option is now being treated as a normal text.

Another option is to not accept the value of the ” *Text” option from any untrusted sources.

References

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41183

https://cwe.mitre.org/data/definitions/79.html

< Return to all Vulnerabilities

Bug Bounties

As pirates, we all love plundering, we all love raiding, but mostly, we all love bounties, especially Bug Bounties. Let’s talk about it. Bug Bounties

Read More »

The Cloud

I’m pretty sure there isn’t a single adult in the world who hasn’t at least heard of The Cloud. Explaining “The Cloud” in 2022 may

Read More »

Exposing the GIT

Let’s start with defining the meaning of GIT. GIT – is an open-source system which we use as a tool to store data and information

Read More »

Blue Team

We’ve talked about The Red Team before, but what about The Blue Team? How is this group different from the red one? Why would we

Read More »