Home > Vulnerability Database > CVE-2021-41182

Mend.io Vulnerability Database

CVE-2021-41182

Good to know:

Date: October 25, 2021

jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the "altField" option of the Datepicker widget from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. Any string value passed to the "altField" option is now treated as a CSS selector. A workaround is to not accept the value of the "altField" option from untrusted sources.

Language: JS

Severity Score

6.5

Related Resources (33)

Url: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HVKIOWSXL2RF2ULNAP7PHESYCFSZIJE3

Url: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SGSY236PYSFYIEBRGDERLA7OSY6D7XL4

Url: https://blog.jqueryui.com/2021/10/jquery-ui-1-13-0-released

Url: https://security.netapp.com/advisory/ntap-20211118-0004

Url: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SNXA7XRKGINWSUIPIZ6ZBCTV6N3KSHES/

Url: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NXIUUBRVLA4E7G7MMIKCEN75YN7UFERW

Url: https://github.com/jquery/jquery-ui

Url: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/O74SXYY7RGXREQDQUDQD4BPJ4QQTD2XQ/

Url: https://security.netapp.com/advisory/ntap-20211118-0004/

Url: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HVKIOWSXL2RF2ULNAP7PHESYCFSZIJE3

Url: https://lists.debian.org/debian-lts-announce/2022/01/msg00014.html

Url: https://www.tenable.com/security/tns-2022-09

Url: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NXIUUBRVLA4E7G7MMIKCEN75YN7UFERW/

Url: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SGSY236PYSFYIEBRGDERLA7OSY6D7XL4

Url: https://www.oracle.com/security-alerts/cpuapr2022.html

Url: https://security-tracker.debian.org/tracker/CVE-2021-41182

Url: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/O74SXYY7RGXREQDQUDQD4BPJ4QQTD2XQ

Url: https://nvd.nist.gov/vuln/detail/CVE-2021-41182

Url: https://www.drupal.org/sa-contrib-2022-004

Url: https://github.com/rubysec/ruby-advisory-db/blob/master/gems/jquery-ui-rails/CVE-2021-41182.yml

Url: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/O74SXYY7RGXREQDQUDQD4BPJ4QQTD2XQ

Url: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SNXA7XRKGINWSUIPIZ6ZBCTV6N3KSHES

Url: https://github.com/jquery/jquery-ui/pull/1954/commits/6809ce843e5ac4128108ea4c15cbc100653c2b63

Url: https://blog.jqueryui.com/2021/10/jquery-ui-1-13-0-released/

Url: https://lists.debian.org/debian-lts-announce/2023/08/msg00040.html

Url: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SGSY236PYSFYIEBRGDERLA7OSY6D7XL4/

Url: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NXIUUBRVLA4E7G7MMIKCEN75YN7UFERW

Url: https://www.oracle.com/security-alerts/cpujul2022.html

Url: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HVKIOWSXL2RF2ULNAP7PHESYCFSZIJE3/

Url: https://www.drupal.org/sa-core-2022-002

Url: https://github.com/jquery/jquery-ui/security/advisories/GHSA-9gj3-hwp5-pmwc

Url: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SNXA7XRKGINWSUIPIZ6ZBCTV6N3KSHES

Url: https://www.mend.io/vulnerability-database/CVE-2021-41182

Severity Score

6.5

Weakness Type (CWE)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CWE-79

Top Fix

Upgrade Version

Upgrade to version jQuery.UI.Combined - 1.13.0;jquery-ui - 1.13.0;jquery-ui-rails - 7.0.0;org.webjars.npm:jquery-ui:1.13.0

Learn More

CVSS v3.1

Base Score:	6.5
Attack Vector (AV):	NETWORK
Attack Complexity (AC):	LOW
Privileges Required (PR):	NONE
User Interaction (UI):	REQUIRED
Scope (S):	UNCHANGED
Confidentiality (C):	NONE
Integrity (I):	HIGH
Availability (A):	NONE

CVSS v2

Base Score:	4.3
Access Vector (AV):	NETWORK
Access Complexity (AC):	MEDIUM
Authentication (AU):	NONE
Confidentiality (C):	NONE
Integrity (I):	PARTIAL
Availability (A):	NONE
Additional information:

Mend.io Vulnerability Database

We found results for “”

CVE-2021-41182

Good to know:

Date: October 25, 2021

Language: JS

Severity Score

Related Resources (33)

Severity Score

Weakness Type (CWE)

Top Fix

Upgrade Version

CVSS v3.1

CVSS v2

Do you need more information?