René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"jquery-2.1.4.min.js: 4 vulnerabilities (highest severity is: 5.7) [master]","articleBody":"\u003cdetails\u003e\n  \u003csummary\u003e📂 Vulnerable Library - \u003cstrong\u003ejquery-2.1.4.min.js\u003c/strong\u003e\u003c/summary\u003e\n\nJavaScript library for DOM operations\n\n**Library home page:** [ https://cdnjs.cloudflare.com/ajax/libs/jquery/2.1.4/jquery.min.js ](https://cdnjs.cloudflare.com/ajax/libs/jquery/2.1.4/jquery.min.js)\n\n\n\n**Path to vulnerable library:** /src/main/webapp/js/jquery.min.js\n\n\n\u003c/details\u003e\n\n\n# Findings\n| Finding | Severity | 🎯 CVSS | Exploit Maturity | EPSS | Library | Type | Fixed in | Remediation Available | **Reachability** |\n| ------------- | ------------- | ---- | --- | ----- | ----- | ----- | --- | --- | --- |\n| [ CVE-2020-11022 ](https://www.mend.io/vulnerability-database/CVE-2020-11022) | 🟠 Medium | 5.7 | Proof of concept | 30.1% | jquery-2.1.4.min.js | Direct | org.webjars.npm:jquery:3.5.0,jquery - 3.5.0,jquery - 3.5.0,jquery-rails - 4.4.0,jquery - 3.5.0,org.webjars.npm:jquery:3.5.0,jquery - 3.5.0,jquery-rails - 4.4.0 | ❌ | |\n| [ CVE-2020-11023 ](https://www.mend.io/vulnerability-database/CVE-2020-11023) | 🟠 Medium | 5.7 | Proof of concept | 27.8% | jquery-2.1.4.min.js | Direct | org.webjars.npm:jquery:3.5.0,jquery - 3.5.0,jquery-rails - 4.4.0,jQuery - 3.5.0,jquery - 3.5.0,jquery-rails - 4.4.0,org.webjars.npm:jquery:3.5.0,jQuery - 3.5.0 | ❌ | |\n| [ CVE-2015-9251 ](https://www.mend.io/vulnerability-database/CVE-2015-9251) | 🟠 Medium | 5.3 | High | 10.1% | jquery-2.1.4.min.js | Direct | jquery - 3.0.0,org.webjars.npm:jquery:1.12.2,jQuery - 3.0.0,jquery-rails - 4.2.0,jquery - 1.12.2,org.webjars.npm:jquery:3.0.0,jQuery - 1.12.2,jQuery - 3.0.0,org.webjars.npm:jquery:1.12.2,org.webjars.npm:jquery:3.0.0,jquery - 3.0.0,jquery - 1.12.2,jQuery - 1.12.2,jquery-rails - 4.2.0 | ❌ | |\n| [ CVE-2019-11358 ](https://www.mend.io/vulnerability-database/CVE-2019-11358) | 🟡 Low | 2.1 | Proof of concept | 5.5% | jquery-2.1.4.min.js | Direct | org.webjars.npm:jquery:3.4.0,django - 2.2.2,jquery - 3.4.0,jquery-rails - 4.3.4,django - 2.1.9,jQuery - 3.4.0,jquery-rails - 4.3.4,django - 2.2.2,django - 2.1.9,org.webjars.npm:jquery:3.4.0,jQuery - 3.4.0,jquery - 3.4.0 | ❌ | |\n\n\n# Details\n\n\n\u003cdetails\u003e\n  \u003csummary\u003e\n 🟠CVE-2020-11022\n  \u003c/summary\u003e\n\n### Vulnerable Library - **jquery-2.1.4.min.js**\n\nJavaScript library for DOM operations\n\n**Library home page:** [ https://cdnjs.cloudflare.com/ajax/libs/jquery/2.1.4/jquery.min.js ](https://cdnjs.cloudflare.com/ajax/libs/jquery/2.1.4/jquery.min.js)\n\n\n\n**Path to vulnerable library:** /src/main/webapp/js/jquery.min.js\n\n\n\n**Dependency Hierarchy:**\n\n\n- ❌  **jquery-2.1.4.min.js** (Vulnerable Library)\n\n\n\n\n***\n\n### Vulnerability Details\n\nIn jQuery versions greater than or equal to 1.2 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.\n\n**Publish Date:** Apr 29, 2020 12:00 AM\n\n**URL:** [ CVE-2020-11022 ](https://www.mend.io/vulnerability-database/CVE-2020-11022)\n\n**Threat Assessment**\n\nExploit Maturity:Proof of concept\n\nEPSS:30.1%\n\n**Score:** 5.7\n\n\n***\n### Suggested Fix\n\n**Type:** Upgrade version\n\n**Origin:** https://github.com/advisories/GHSA-gxr4-xjj5-5px2\n\n**Release Date:** Apr 29, 2020 12:00 AM\n\n**Fix Resolution :** org.webjars.npm:jquery:3.5.0,jquery - 3.5.0,jquery - 3.5.0,jquery-rails - 4.4.0,jquery - 3.5.0,org.webjars.npm:jquery:3.5.0,jquery - 3.5.0,jquery-rails - 4.4.0\n\n\n\u003c/details\u003e\n\n\u003cdetails\u003e\n  \u003csummary\u003e\n 🟠CVE-2020-11023\n  \u003c/summary\u003e\n\n### Vulnerable Library - **jquery-2.1.4.min.js**\n\nJavaScript library for DOM operations\n\n**Library home page:** [ https://cdnjs.cloudflare.com/ajax/libs/jquery/2.1.4/jquery.min.js ](https://cdnjs.cloudflare.com/ajax/libs/jquery/2.1.4/jquery.min.js)\n\n\n\n**Path to vulnerable library:** /src/main/webapp/js/jquery.min.js\n\n\n\n**Dependency Hierarchy:**\n\n\n- ❌  **jquery-2.1.4.min.js** (Vulnerable Library)\n\n\n\n\n***\n\n### Vulnerability Details\n\nIn jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing \u003coption\u003e elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.\n\n**Publish Date:** Apr 29, 2020 12:00 AM\n\n**URL:** [ CVE-2020-11023 ](https://www.mend.io/vulnerability-database/CVE-2020-11023)\n\n**Threat Assessment**\n\nExploit Maturity:Proof of concept\n\nEPSS:27.8%\n\n**Score:** 5.7\n\n\n***\n### Suggested Fix\n\n**Type:** Upgrade version\n\n**Origin:** https://github.com/advisories/GHSA-jpcq-cgw6-v4j6\n\n**Release Date:** Apr 29, 2020 12:00 AM\n\n**Fix Resolution :** org.webjars.npm:jquery:3.5.0,jquery - 3.5.0,jquery-rails - 4.4.0,jQuery - 3.5.0,jquery - 3.5.0,jquery-rails - 4.4.0,org.webjars.npm:jquery:3.5.0,jQuery - 3.5.0\n\n\n\u003c/details\u003e\n\n\u003cdetails\u003e\n  \u003csummary\u003e\n 🟠CVE-2015-9251\n  \u003c/summary\u003e\n\n### Vulnerable Library - **jquery-2.1.4.min.js**\n\nJavaScript library for DOM operations\n\n**Library home page:** [ https://cdnjs.cloudflare.com/ajax/libs/jquery/2.1.4/jquery.min.js ](https://cdnjs.cloudflare.com/ajax/libs/jquery/2.1.4/jquery.min.js)\n\n\n\n**Path to vulnerable library:** /src/main/webapp/js/jquery.min.js\n\n\n\n**Dependency Hierarchy:**\n\n\n- ❌  **jquery-2.1.4.min.js** (Vulnerable Library)\n\n\n\n\n***\n\n### Vulnerability Details\n\njQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed.\n\n**Publish Date:** Jan 18, 2018 11:00 PM\n\n**URL:** [ CVE-2015-9251 ](https://www.mend.io/vulnerability-database/CVE-2015-9251)\n\n**Threat Assessment**\n\nExploit Maturity:High\n\nEPSS:10.1%\n\n**Score:** 5.3\n\n\n***\n### Suggested Fix\n\n**Type:** Upgrade version\n\n**Origin:** https://github.com/advisories/GHSA-rmxg-73gg-4p98\n\n**Release Date:** Jan 18, 2018 11:00 PM\n\n**Fix Resolution :** jquery - 3.0.0,org.webjars.npm:jquery:1.12.2,jQuery - 3.0.0,jquery-rails - 4.2.0,jquery - 1.12.2,org.webjars.npm:jquery:3.0.0,jQuery - 1.12.2,jQuery - 3.0.0,org.webjars.npm:jquery:1.12.2,org.webjars.npm:jquery:3.0.0,jquery - 3.0.0,jquery - 1.12.2,jQuery - 1.12.2,jquery-rails - 4.2.0\n\n\n\u003c/details\u003e\n\n\u003cdetails\u003e\n  \u003csummary\u003e\n 🟡CVE-2019-11358\n  \u003c/summary\u003e\n\n### Vulnerable Library - **jquery-2.1.4.min.js**\n\nJavaScript library for DOM operations\n\n**Library home page:** [ https://cdnjs.cloudflare.com/ajax/libs/jquery/2.1.4/jquery.min.js ](https://cdnjs.cloudflare.com/ajax/libs/jquery/2.1.4/jquery.min.js)\n\n\n\n**Path to vulnerable library:** /src/main/webapp/js/jquery.min.js\n\n\n\n**Dependency Hierarchy:**\n\n\n- ❌  **jquery-2.1.4.min.js** (Vulnerable Library)\n\n\n\n\n***\n\n### Vulnerability Details\n\njQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable proto property, it could extend the native Object.prototype.\n Mend Note: The description of this vulnerability differs from MITRE. \n\n**Publish Date:** Apr 19, 2019 12:00 AM\n\n**URL:** [ CVE-2019-11358 ](https://www.mend.io/vulnerability-database/CVE-2019-11358)\n\n**Threat Assessment**\n\nExploit Maturity:Proof of concept\n\nEPSS:5.5%\n\n**Score:** 2.1\n\n\n***\n### Suggested Fix\n\n**Type:** Upgrade version\n\n**Origin:** https://github.com/advisories/GHSA-6c3j-c64m-qhgq\n\n**Release Date:** Apr 19, 2019 12:00 AM\n\n**Fix Resolution :** org.webjars.npm:jquery:3.4.0,django - 2.2.2,jquery - 3.4.0,jquery-rails - 4.3.4,django - 2.1.9,jQuery - 3.4.0,jquery-rails - 4.3.4,django - 2.2.2,django - 2.1.9,org.webjars.npm:jquery:3.4.0,jQuery - 3.4.0,jquery - 3.4.0\n\n\n\u003c/details\u003e\n\n[comment]: \u003c\u003e (\u003cMEND_ISSUE_METADATA\u003e{\"identifier\":\"jquery-2.1.4.min.js\",\"repoName\":\"BenchmarkJava\",\"branchName\":\"master\",\"type\":\"SCA_DEP\"}\u003c/MEND_ISSUE_METADATA\u003e)","author":{"url":"https://github.com/mend-developer-platform-dev[bot]","@type":"Person","name":"mend-developer-platform-dev[bot]"},"datePublished":"2025-09-28T05:43:39.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":0},"url":"https://github.com/34/BenchmarkJava/issues/34"}