Potential XSS in jQuery dependency in Mirador

published 2020-09-18 6y ago modified 2021-10-04 5y ago

cvss: —; not scored
cisa kev: Not listed; not in CISA's catalog
epss: —; no score, EPSS covers CVEs only
public exploits: 0; none known

### Impact Mirador users less than v3.0.0 (alpha-rc) versions that have an unpatched jQuery. When adopters update jQuery they will find some of Mirador functionality to be broken.

### Patches Mirador adopters should update to v3.0.0, no updates exist for v2.x releases.

### Workarounds Yes, Mirador users could fork and create their own custom build of Mirador and make the bug fixes themselves.

### References https://github.com/advisories/GHSA-gxr4-xjj5-5px2 https://github.com/advisories/GHSA-jpcq-cgw6-v4j6

https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/ https://jquery.com/upgrade-guide/3.5/

Patch / fix

fixed in 1

npm mirador 3.0.0-alpha.0

Is GHSA-hgwm-pv9h-q5m7 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Affected packages

ecosystem	package	affected	fixed in
npm	mirador	<3.0.0-alpha.0	3.0.0-alpha.0

Classification

Weakness

CWE-79 Improper Neutralization of Input During Web Page Generation

References

Sources

GitHub Advisory GHSA-hgwm-pv9h-q5m7

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.