[Security] Outdated jQuery Version with Known Vulnerabilities

[mrlesmithjr]

Summary

jQuery 3.4.1 contains known XSS vulnerabilities (CVE-2020-11022 and CVE-2020-11023) that could be exploited.

Location

assets/js/vendor/jquery/jquery-3.4.1.js

Description

The site uses jQuery 3.4.1, which has two known XSS vulnerabilities in the htmlPrefilter function:

• CVE-2020-11022: XSS via <option> and <style> tags
• CVE-2020-11023: XSS via untrusted HTML passed to DOM manipulation methods

Impact

Attackers could potentially exploit these vulnerabilities to execute malicious JavaScript if user-controlled data is passed to jQuery DOM manipulation functions without proper sanitization.

Remediation

Upgrade jQuery to version 3.7.1 or later:

1. Download latest jQuery from https://jquery.com/download/
2. Replace assets/js/vendor/jquery/jquery-3.4.1.js with new version
3. Update references in templates/layouts
4. Test all JavaScript functionality

Priority

P2 (Medium) - Known CVEs should be addressed

References

• CVE-2020-11022
• CVE-2020-11023
• jQuery Security Releases
• CWE-79: Cross-site Scripting