CVE-2021-41184 : jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0

jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the `of` option of the `.position()` util from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. Any string value passed to the `of` option is now treated as a CSS selector. A workaround is to not accept the value of the `of` option from untrusted sources.

Published 2021-10-26 15:15:10

Updated 2023-08-31 03:15:14

Source GitHub, Inc.

View at NVD, CVE.org

Vulnerability category: Cross site scripting (XSS)

Products affected by CVE-2021-41184

Oracle » Peoplesoft Enterprise Peopletools » Version: 8.58
cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:*
Matching versions
Oracle » Peoplesoft Enterprise Peopletools » Version: 8.59
cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.59:*:*:*:*:*:*:*
Matching versions
Oracle » Application Express
Versions before (<) 22.1.1
cpe:2.3:a:oracle:application_express:*:*:*:*:*:*:*:*
Matching versions
Oracle » Weblogic Server » Version: 12.2.1.3.0
cpe:2.3:a:oracle:weblogic_server:12.2.1.3.0:*:*:*:*:*:*:*
Matching versions
Oracle » Weblogic Server » Version: 12.2.1.4.0
cpe:2.3:a:oracle:weblogic_server:12.2.1.4.0:*:*:*:*:*:*:*
Matching versions
Oracle » Weblogic Server » Version: 14.1.1.0.0
cpe:2.3:a:oracle:weblogic_server:14.1.1.0.0:*:*:*:*:*:*:*
Matching versions
Oracle » Jd Edwards Enterpriseone Tools
Versions up to, including, (<=) 9.2.6.3
cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:*:*:*:*:*:*:*:*
Matching versions
Oracle » Communications Operations Monitor » Version: 4.3
cpe:2.3:a:oracle:communications_operations_monitor:4.3:*:*:*:*:*:*:*
Matching versions
Oracle » Communications Operations Monitor » Version: 4.4
cpe:2.3:a:oracle:communications_operations_monitor:4.4:*:*:*:*:*:*:*
Matching versions
Oracle » Communications Operations Monitor » Version: 5.0
cpe:2.3:a:oracle:communications_operations_monitor:5.0:*:*:*:*:*:*:*
Matching versions
Oracle » Banking Platform » Version: 2.9.0
cpe:2.3:a:oracle:banking_platform:2.9.0:*:*:*:*:*:*:*
Matching versions
Oracle » Banking Platform » Version: 2.12.0
cpe:2.3:a:oracle:banking_platform:2.12.0:*:*:*:*:*:*:*
Matching versions
Oracle » Primavera Unifier
Versions from including (>=) 17.7 and up to, including, (<=) 17.12
cpe:2.3:a:oracle:primavera_unifier:*:*:*:*:*:*:*:*
Matching versions
Oracle » Primavera Unifier » Version: 18.8
cpe:2.3:a:oracle:primavera_unifier:18.8:*:*:*:*:*:*:*
Matching versions
Oracle » Primavera Unifier » Version: 19.12
cpe:2.3:a:oracle:primavera_unifier:19.12:*:*:*:*:*:*:*
Matching versions
Oracle » Primavera Unifier » Version: 20.12
cpe:2.3:a:oracle:primavera_unifier:20.12:*:*:*:*:*:*:*
Matching versions
Oracle » Primavera Unifier » Version: 21.12
cpe:2.3:a:oracle:primavera_unifier:21.12:*:*:*:*:*:*:*
Matching versions
Oracle » Hospitality Inventory Management » Version: 9.1.0
cpe:2.3:a:oracle:hospitality_inventory_management:9.1.0:*:*:*:*:*:*:*
Matching versions
Oracle » Hospitality Suite8
Versions from including (>=) 8.11.0 and up to, including, (<=) 8.14.0
cpe:2.3:a:oracle:hospitality_suite8:*:*:*:*:*:*:*:*
Matching versions
Oracle » Hospitality Suite8 » Version: 8.10.2
cpe:2.3:a:oracle:hospitality_suite8:8.10.2:*:*:*:*:*:*:*
Matching versions
Oracle » Hospitality Materials Control » Version: 18.1
cpe:2.3:a:oracle:hospitality_materials_control:18.1:*:*:*:*:*:*:*
Matching versions
Oracle » Policy Automation
Versions from including (>=) 12.2.0 and up to, including, (<=) 12.2.25
cpe:2.3:a:oracle:policy_automation:*:*:*:*:*:*:*:*
Matching versions
Oracle » Communications Interactive Session Recorder » Version: 6.4
cpe:2.3:a:oracle:communications_interactive_session_recorder:6.4:*:*:*:*:*:*:*
Matching versions
Oracle » Agile Plm » Version: 9.3.6
cpe:2.3:a:oracle:agile_plm:9.3.6:*:*:*:*:*:*:*
Matching versions
Oracle » Rest Data Services »
Versions before (<) 22.1.1
cpe:2.3:a:oracle:rest_data_services:*:*:*:*:-:*:*:*
Matching versions
Oracle » Rest Data Services » Version: 22.1.1
cpe:2.3:a:oracle:rest_data_services:22.1.1:*:*:*:-:*:*:*
Matching versions
Oracle » Big Data Spatial And Graph
Versions before (<) 23.1
cpe:2.3:a:oracle:big_data_spatial_and_graph:*:*:*:*:*:*:*:*
Matching versions
Oracle » Big Data Spatial And Graph » Version: 23.1
cpe:2.3:a:oracle:big_data_spatial_and_graph:23.1:*:*:*:*:*:*:*
Matching versions
Drupal » Drupal
Versions from including (>=) 7.0 and before (<) 7.86
cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*
Matching versions
Drupal » Drupal
Versions from including (>=) 9.2.0 and before (<) 9.2.11
cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*
Matching versions
Drupal » Drupal
Versions from including (>=) 9.3.0 and before (<) 9.3.3
cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*
Matching versions
Fedoraproject » Fedora » Version: 33
cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*
Matching versions
Fedoraproject » Fedora » Version: 34
cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
Matching versions
Fedoraproject » Fedora » Version: 35
cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*
Matching versions
Fedoraproject » Fedora » Version: 36
cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*
Matching versions
Netapp » H410c Firmware » Version: N/A
cpe:2.3:o:netapp:h410c_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Netapp » H410c » Version: N/A
Netapp » H300s Firmware » Version: N/A
cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Netapp » H300s » Version: N/A
Netapp » H500s Firmware » Version: N/A
cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Netapp » H500s » Version: N/A
Netapp » H700s Firmware » Version: N/A
cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Netapp » H700s » Version: N/A
Netapp » H300e Firmware » Version: N/A
cpe:2.3:o:netapp:h300e_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Netapp » H300e » Version: N/A
Netapp » H500e Firmware » Version: N/A
cpe:2.3:o:netapp:h500e_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Netapp » H500e » Version: N/A
Netapp » H700e Firmware » Version: N/A
cpe:2.3:o:netapp:h700e_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Netapp » H700e » Version: N/A
Netapp » H410s Firmware » Version: N/A
cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Netapp » H410s » Version: N/A
Tenable » Tenable.sc
Versions before (<) 5.21.0
cpe:2.3:a:tenable:tenable.sc:*:*:*:*:*:*:*:*
Matching versions
Jqueryui » Jquery Ui » For Jquery
Versions before (<) 1.13.0
cpe:2.3:a:jqueryui:jquery_ui:*:*:*:*:*:jquery:*:*
Matching versions

Threat overview for CVE-2021-41184

Top countries where our scanners detected CVE-2021-41184

Top open port discovered on systems with this issue 80

IPs affected by CVE-2021-41184 124,443

Threat actors abusing to this issue? Yes

Find out if you^* are affected by CVE-2021-41184!

^*Directly or indirectly through your vendors, service providers and 3rd parties. Powered by attack surface intelligence from SecurityScorecard.

Exploit prediction scoring system (EPSS) score for CVE-2021-41184

EPSS FAQ

0.45%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 75 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2021-41184

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
4.3	MEDIUM	AV:N/AC:M/Au:N/C:N/I:P/A:N	8.6	2.9	NIST
Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: None Integrity Impact: Partial Availability Impact: None
6.1	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	2.8	2.7	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: Required Scope: Changed Confidentiality: Low Integrity: Low Availability: None
6.5	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N	2.8	3.6	GitHub, Inc.
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: Required Scope: Unchanged Confidentiality: None Integrity: High Availability: None

CWE ids for CVE-2021-41184

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Assigned by:
- nvd@nist.gov (Secondary)
- security-advisories@github.com (Primary)

References for CVE-2021-41184

https://www.oracle.com/security-alerts/cpuapr2022.html

Oracle Critical Patch Update Advisory - April 2022
Patch;Third Party Advisory

CVEs referencing this url
https://www.drupal.org/sa-core-2022-001

Drupal core - Moderately critical - Cross Site Scripting - SA-CORE-2022-001 | Drupal.org
Third Party Advisory

CVEs referencing this url
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/O74SXYY7RGXREQDQUDQD4BPJ4QQTD2XQ/

[SECURITY] Fedora 35 Update: js-jquery-ui-1.13.0-1.fc35 - package-announce - Fedora Mailing-Lists
Mailing List;Third Party Advisory

CVEs referencing this url
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HVKIOWSXL2RF2ULNAP7PHESYCFSZIJE3/

[SECURITY] Fedora 36 Update: drupal7-7.92-1.fc36 - package-announce - Fedora Mailing-Lists
Mailing List;Third Party Advisory

CVEs referencing this url
https://www.tenable.com/security/tns-2022-09

[R1] Tenable.sc 5.21.0 Fixes Multiple Third-Party Vulnerabilities - Security Advisory | Tenable®
Patch;Release Notes;Third Party Advisory

CVEs referencing this url
https://blog.jqueryui.com/2021/10/jquery-ui-1-13-0-released/

jQuery UI 1.13.0 released | jQuery UI Blog
Release Notes;Vendor Advisory

CVEs referencing this url
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SGSY236PYSFYIEBRGDERLA7OSY6D7XL4/

[SECURITY] Fedora 35 Update: drupal7-7.92-1.fc35 - package-announce - Fedora Mailing-Lists
Mailing List;Third Party Advisory

CVEs referencing this url
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SNXA7XRKGINWSUIPIZ6ZBCTV6N3KSHES/

[SECURITY] Fedora 34 Update: js-jquery-ui-1.13.0-1.fc34 - package-announce - Fedora Mailing-Lists
Mailing List;Third Party Advisory

CVEs referencing this url
https://github.com/jquery/jquery-ui/security/advisories/GHSA-gpqq-952q-5327

XSS in the `of` option of the `.position()` util · Advisory · jquery/jquery-ui · GitHub
Mitigation;Patch;Vendor Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NXIUUBRVLA4E7G7MMIKCEN75YN7UFERW/

[SECURITY] Fedora 33 Update: js-jquery-ui-1.13.0-1.fc33 - package-announce - Fedora Mailing-Lists
Mailing List;Third Party Advisory

CVEs referencing this url
https://github.com/jquery/jquery-ui/commit/effa323f1505f2ce7a324e4f429fa9032c72f280

Position: Make sure `of` is treated as a CSS selector · jquery/jquery-ui@effa323 · GitHub
Patch;Vendor Advisory
https://security.netapp.com/advisory/ntap-20211118-0004/

October 2021 jQuery Vulnerabilities in NetApp Products | NetApp Product Security
Third Party Advisory

CVEs referencing this url
https://www.oracle.com/security-alerts/cpujul2022.html

Oracle Critical Patch Update Advisory - July 2022
Third Party Advisory

CVEs referencing this url
https://lists.debian.org/debian-lts-announce/2023/08/msg00040.html

[SECURITY] [DLA 3551-1] otrs2 security update

CVEs referencing this url