PT-2007-1156 · Jquery+6 · Jquery+6
CVE-2015-9251
·
Publicado
2007-04-10
·
Atualizado
2026-03-01
CVSS v2.0
6.4
Média
| Vetor | AV:N/AC:L/Au:N/C:P/I:P/A:N |
Name of the Vulnerable Software and Affected Versions:
jquery versions prior to 3.0.0
Description:
The issue is related to the lack of protection for the structure of web pages, allowing a remote attacker to perform cross-site scripting using cross-domain ajax requests. When a cross-domain Ajax request is performed without the dataType option, it causes text/javascript responses to be executed. The
jQuery.globalEval function automatically executes the contents of text/javascript responses from cross-origin ajax requests, even when the ajax request doesn't contain the dataType option.Recommendations:
Update to version 3.0.0 or later. As a temporary workaround, consider setting the
dataType option for all cross-domain Ajax requests to prevent automatic execution of text/javascript responses. Restrict access to the jQuery.globalEval function to minimize the risk of exploitation. Avoid using cross-domain ajax requests without the dataType option until the issue is resolved.Exploit
Correção
XSS
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Almalinux
Centos
Oracle Weblogic Server
Red Hat
Rocky Linux
Suse
Jquery