PT-2007-1156 · Jquery+6 · Jquery+6
Published
2007-04-10
·
Updated
2026-03-01
·
CVE-2015-9251
CVSS v2.0
6.4
Medium
| Vector | AV:N/AC:L/Au:N/C:P/I:P/A:N |
Name of the Vulnerable Software and Affected Versions:
jquery versions prior to 3.0.0
Description:
The issue is related to the lack of protection for the structure of web pages, allowing a remote attacker to perform cross-site scripting using cross-domain ajax requests. When a cross-domain Ajax request is performed without the dataType option, it causes text/javascript responses to be executed. The
jQuery.globalEval function automatically executes the contents of text/javascript responses from cross-origin ajax requests, even when the ajax request doesn't contain the dataType option.Recommendations:
Update to version 3.0.0 or later. As a temporary workaround, consider setting the
dataType option for all cross-domain Ajax requests to prevent automatic execution of text/javascript responses. Restrict access to the jQuery.globalEval function to minimize the risk of exploitation. Avoid using cross-domain ajax requests without the dataType option until the issue is resolved.Exploit
Fix
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Almalinux
Centos
Oracle Weblogic Server
Red Hat
Rocky Linux
Suse
Jquery