PT-2022-10654 · Unknown · Jquery File Upload

Published 2022-02-25 · Updated 2024-02-14 · CVE-2021-37504

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions jQuery-Upload-File version 4.0.11

Description A cross-site scripting (XSS) issue exists due to a vulnerability in the fileNameStr parameter, allowing attackers to execute arbitrary web scripts or HTML via a crafted file with a Javascript payload in the file name.

Recommendations For jQuery-Upload-File version 4.0.11, consider validating and sanitizing the fileNameStr parameter to prevent the execution of malicious scripts. As a temporary workaround, restrict the ability to upload files with potentially malicious names until a patch is available.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-37504

GHSA-43X9-7HFV-MXRF

Affected Products

Jquery File Upload

References · 12

• https://osv.dev/vulnerability/CVE-2021-37504 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-37504 · Security Note
• https://osv.dev/vulnerability/GHSA-43x9-7hfv-mxrf · Vendor Advisory
• https://github.com/hayageek/jquery-upload-file · Note
• https://github.com/hayageek/jquery-upload-file/blob/master/js/jquery.uploadfile.js#L469 · Note
• https://t.me/cvenotify/27878 · Telegram Post
• http://haygeek.com · Note
• http://hayageek.github.io/jQuery-Upload-File/4.0.11/uploadfile.css · Note
• https://raw.githubusercontent.com/hayageek/jquery-upload-file/master/js/jquery.uploadfile.js · Note
• http://ajax.googleapis.com/ajax/libs/jquery/1.9.1/jquery.min.js · Note
• http://hayageek.github.io/jQuery-Upload-File/4.0.11/jquery.uploadfile.min.js · Note
• http://jquery-upload-file.com · Note