PT-2013-1330 · Jquery · Jquery

One70Six

·

Publicado

2013-03-08

·

Atualizado

2022-05-14

·

CVE-2011-4969

CVSS v2.0

4.3

Média

VetorAV:N/AC:M/Au:N/C:N/I:P/A:N
Name of the Vulnerable Software and Affected Versions jQuery versions prior to 1.6.3
Description The issue is related to a lack of protection for the web page structure, allowing for the injection of arbitrary web scripts or HTML code. This can be exploited by a remote attacker to inject malicious code via a crafted tag, specifically when using location.hash to select elements.
Recommendations For jQuery versions prior to 1.6.3, update to version 1.6.3 or later to resolve the issue. As a temporary workaround, consider avoiding the use of location.hash to select elements until a patch is applied. Restrict access to potentially vulnerable web pages to minimize the risk of exploitation.

Exploit

Correção

XSS

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

AZL-44421
BDU:2022-02606
CVE-2011-4969
GHSA-579V-MP3V-RRW5

Produtos afetados

Jquery