CVE-2011-4969: jquery

Modified

AliasesGHSA-579v-mp3v-rrw5

Published 08-03-2013Last modified 07-08-2024

Vulnerability summary

CVE-2011-4969 is a medium (CVSS 4.3) vulnerability in jquery. EPSS estimates a 19.19% chance of exploitation in the next 30 days, higher than 97.3% of scored vulnerabilities. 1 public exploit is recorded.

Priority

Routine

Not severe (CVSS 4.3, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

4.3/10

010

Medium · v2.0 (NVD)

EPSS score

19.19%

0%100%

Medium · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits1github

Advisory lineage

Upstream 0 · Downstream 0 · Duplicates 1

CVE-2013-5989

Timeline

08-03-2013
PublishedVulnerability first disclosed.
07-08-2024
Last modifiedVulnerability information updated.

Description

Cross-site scripting (XSS) vulnerability in jQuery before 1.6.3, when using location.hash to select elements, allows remote attackers to inject arbitrary web script or HTML via a crafted tag.

CVSS metrics

1 score · 1 source · 1 version

v2.04.3

EPSS trend

Probability

19.19%

Chance of exploitation in the next 30 days

Percentile

97%

Versus all other CVEs

30-day change

No change 0.00 pp

From 19.19% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

1 found

githubUnverified
Jquery
Maturity: poc

Weaknesses

CWE · root cause

CWE-79Improper Neutralization of Input During Web Page GenerationThe product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Affected systems

Version check

Known conditions: network-reachable, no authentication (CVSS vector). Other conditions: not stated in public data.

Debian1 product

jquery< 1.6.4-1

Jquery1 product

jqueryEOL≤ 1.6.2 | 1.6 | 1.6.1

Npm1 product

jquery< 1.6.3

NuGet1 product

jquery< 1.6.3

Org.webjars.npm1 product

jquery< 1.6.3

RubyGems1 product

jquery-rails< 1.0.16

6 vendors · 6 products

References

21 links

www.securitytracker.com/id/1036620VDB EntryX Refsource SECTRACKWEB
www.osvdb.org/80056VDB EntryX Refsource OSVDBWEB
bugs.jquery.com/ticket/9521X Refsource CONFIRMWEB
h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05111017X Refsource CONFIRMWEB
blog.jquery.com/2011/09/01/jquery-1-6-3-released/X Refsource CONFIRMARTICLE
blog.mindedsecurity.com/2011/07/jquery-is-sink.htmlX Refsource MISCARTICLEWEB
h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05158380X Refsource CONFIRMWEB
github.com/jquery/jquery/commit/db9e023e62c1ff5d8f21ed9868ab6878da2005e9X Refsource CONFIRMExploitPatchFIXWEB
h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05232730X Refsource CONFIRMWEB
www.ubuntu.com/usn/USN-1722-1Vendor AdvisoryX Refsource UBUNTUAdvisoryWEB

Show all 21 references

www.openwall.com/lists/oss-security/2013/01/31/3Mailing ListX Refsource MLISTWEB
www.securityfocus.com/bid/58458VDB EntryX Refsource BIDWEB
security.netapp.com/advisory/ntap-20190416-0007/X Refsource CONFIRMAdvisory
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTWEB
nvd.nist.gov/vuln/detail/CVE-2011-4969Advisory
github.com/jquery/jqueryPACKAGE
github.com/rubysec/ruby-advisory-db/blob/master/gems/jquery-rails/CVE-2011-4969.ymlWEB
lists.apache.org/thread.html/…WEB
security.netapp.com/advisory/ntap-20190416-0007WEB
security.snyk.io/vuln/SNYK-DOTNET-JQUERY-450224WEB
blog.jquery.com/2011/09/01/jquery-1-6-3-releasedWEB