CVE-2021-41182 @ Npm-jquery-ui-1.10.4 #802
Description
Vulnerable Package issue exists @ Npm-jquery-ui-1.10.4 in branch main
jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0-alpha.1, accepting the value of the altField option of the Datepicker widget from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0-alpha.1. Any string value passed to the altField option is now treated as a CSS selector. A workaround is to not accept the value of the altField option from untrusted sources.
Namespace: CxDemoInABoxRepos
Repository: Java-Webgoat
Repository Url: https://github.com/CxDemoInABoxRepos/Java-Webgoat
CxAST-Project: CxDemoInABoxRepos/Java-Webgoat
CxAST platform scan: 15076145-61a1-4d21-a896-a138ffd875d6
Branch: main
Application: Java-Webgoat
Severity: MEDIUM
State: TO_VERIFY
Status: RECURRENT
CWE: CWE-79
Additional Info
Attack vector: NETWORK
Attack complexity: LOW
Confidentiality impact: LOW
Availability impact: NONE
Remediation Upgrade Recommendation: 1.13.0
References
Advisory
Release Note
Pull request
Commit