PT-2023-12182 · Unknown+1 · Jquery Minicolors+1

Erik Krogh Kristensen + 1 · Published 2023-02-20 · Updated 2024-02-29 · CVE-2021-32850

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions jQuery MiniColors versions prior to 2.3.6

Description The issue is related to cross-site scripting when handling untrusted color names. This can be exploited due to the lack of proper input validation in jQuery MiniColors.

Recommendations For versions prior to 2.3.6, update to version 2.3.6 to resolve the issue. As a temporary workaround, consider validating and sanitizing color names to prevent cross-site scripting attacks.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-32850

GHSA-CRH5-VV2V-C82Q

MGASA-2024-0052

Affected Products

Debian

Jquery Minicolors

References · 31

• 🔥 https://securitylab.github.com/advisories/GHSL-2021-1045_jQuery_MiniColors_Plugin · Exploit
• https://github.com/claviska/jquery-minicolors/commit/ef134824a7f4110ada53ea6c173111a4fa2f48f3 · Patch
• https://security-tracker.debian.org/tracker/CVE-2021-32850 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-32850 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MC5HV4ESLV2E23YGHNJ542QEZBH6YE2F · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-32850 · Vendor Advisory
• https://security-tracker.debian.org/tracker/source-package/jquery-minicolors · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/MC5HV4ESLV2E23YGHNJ542QEZBH6YE2F · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-32850 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UDXBWA54A7D6HMR2TN5BAYNCU7HO2PUO · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-32850 · Security Note
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/UDXBWA54A7D6HMR2TN5BAYNCU7HO2PUO · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-32850 · Security Note
• https://osv.dev/vulnerability/MGASA-2024-0052 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-32850 · Vendor Advisory