CVE-2021-41183 (Medium) detected in jquery-ui-1.12.1.jar - autoclosed

[mend-for-github-com]

CVE-2021-41183 - Medium Severity Vulnerability

Vulnerable Library - jquery-ui-1.12.1.jar

WebJar for jQuery UI

Library home page: http://webjars.org

Path to dependency file: /web/nibrs-web/pom.xml

Path to vulnerable library: /canner/.m2/repository/org/webjars/jquery-ui/1.12.1/jquery-ui-1.12.1.jar,/web/nibrs-web/target/nibrs-web/WEB-INF/lib/jquery-ui-1.12.1.jar

Dependency Hierarchy:

• ❌ jquery-ui-1.12.1.jar (Vulnerable Library)

Found in HEAD commit: e33ecd45d71662f63121c238ca1c416a6631a650

Found in base branch: master

Vulnerability Details

jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of various *Text options of the Datepicker widget from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. The values passed to various *Text options are now always treated as pure text, not HTML. A workaround is to not accept the value of the *Text options from untrusted sources.

Publish Date: 2021-10-26

URL: CVE-2021-41183

CVSS 3 Score Details (6.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41183

Release Date: 2021-10-26

Fix Resolution: 1.13.0

---

⛑️ Automatic Remediation will be attempted for this issue.