CVE-2021-41183: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
(updated )
jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of various *Text options of the Datepicker widget from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. The values passed to various *Text options are now always treated as pure text, not HTML. A workaround is to not accept the value of the *Text options from untrusted sources.
References
- blog.jqueryui.com/2021/10/jquery-ui-1-13-0-released/
- bugs.jqueryui.com/ticket/15284
- github.com/advisories/GHSA-j7qv-pgf6-hvh4
- github.com/jquery/jquery-ui/pull/1953
- github.com/jquery/jquery-ui/security/advisories/GHSA-j7qv-pgf6-hvh4
- lists.debian.org/debian-lts-announce/2022/01/msg00014.html
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NXIUUBRVLA4E7G7MMIKCEN75YN7UFERW/
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/O74SXYY7RGXREQDQUDQD4BPJ4QQTD2XQ/
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SNXA7XRKGINWSUIPIZ6ZBCTV6N3KSHES/
- nvd.nist.gov/vuln/detail/CVE-2021-41183
- security.netapp.com/advisory/ntap-20211118-0004/
- www.drupal.org/sa-contrib-2022-004
- www.drupal.org/sa-core-2022-001
- www.drupal.org/sa-core-2022-002
Code Behaviors & Features
Detect and mitigate CVE-2021-41183 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →