CVE-2015-9251: jquery

Modified

AliasesALPINE-CVE-2015-9251UBUNTU-CVE-2015-9251GHSA-rmxg-73gg-4p98

Published 18-01-2018Last modified 06-08-2024

Vulnerability summary

CVE-2015-9251 is a medium (CVSS 6.1) vulnerability in jquery. EPSS estimates a 29.73% chance of exploitation in the next 30 days, higher than 98.1% of scored vulnerabilities.

Priority

Routine

Not severe (CVSS 6.1, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

6.1/10

010

Medium · v3.0 (NVD)

EPSS score

29.73%

0%100%

High · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 8 · Duplicates 1 · Related 2

OPENSUSE-SU-2020:0395-1 RHSA-2020:3936 RHSA-2020:4670 RHSA-2020:4847 RHSA-2023:0552 RHSA-2023:0553+3 more

Timeline

18-01-2018
PublishedVulnerability first disclosed.
06-08-2024
Last modifiedVulnerability information updated.

Description

jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed.

CVSS metrics

8 scores · 7 sources · 2 versions

v3.06.1v2.04.3

EPSS trend

Probability

29.73%

Chance of exploitation in the next 30 days

Percentile

98%

Versus all other CVEs

30-day change

No change 0.00 pp

From 29.73% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-79Improper Neutralization of Input During Web Page GenerationThe product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Affected systems

Version check

Known conditions: network-reachable, no authentication, user interaction (CVSS vector). Other conditions: not stated in public data.

Oracle46 products

agile_product_lifecycle_management_for_process6.2.0.0 | 6.2.1.0 | 6.2.2.0 | 6.2.3.0 | 6.2.3.1
banking_platform2.6.0 | 2.6.1 | 2.6.2
business_process_management_suite11.1.1.9.0 | 12.1.3.0.0 | 12.2.1.3.0
communications_converged_application_server< 7.0.0.1
communications_interactive_session_recorder6.0 | 6.1 | 6.2

Show all 46

Alpine2 products

rabbitmq-server< 3.7.17-r0
ruby< 2.5.6-r0

Jquery1 product

jquery< 3.0.0

Npm1 product

jquery< 1.12.2 | ≥ 1.12.3, < 3.0.0

NuGet1 product

jquery< 1.12.2 | ≥ 1.12.3, < 3.0.0

Org.webjars.npm1 product

jquery< 1.12.2 | ≥ 1.12.3, < 3.0.0

RubyGems1 product

jquery-rails< 4.2.0

Ubuntu1 product

jqueryAll versions (No fix recorded)

8 vendors · 54 products

References

60 links

www.securityfocus.com/bid/105658VDB EntryX Refsource BIDThird Party Advisory
seclists.org/bugtraq/2019/May/18Mailing ListX Refsource BUGTRAQWEB
seclists.org/fulldisclosure/2019/May/11Mailing ListX Refsource FULLDISCWEB
seclists.org/fulldisclosure/2019/May/10Mailing ListX Refsource FULLDISCWEB
seclists.org/fulldisclosure/2019/May/13Mailing ListX Refsource FULLDISCWEB
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST

Show all 60 references

lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
access.redhat.com/errata/RHSA-2020:0481Vendor AdvisoryX Refsource REDHATWEB
access.redhat.com/errata/RHSA-2020:0729Vendor AdvisoryX Refsource REDHATWEB
lists.opensuse.org/opensuse-security-announce/2020-03/msg00041.htmlVendor AdvisoryX Refsource SUSEWEB
www.oracle.com/security-alerts/cpuapr2020.htmlX Refsource MISCWEB
www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.htmlX Refsource CONFIRMPatchWEB
www.oracle.com/security-alerts/cpujul2020.htmlX Refsource MISCWEB
github.com/jquery/jquery/issues/2432X Refsource MISCIssue TrackingPatchThird Party AdvisoryWEB
www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.htmlX Refsource CONFIRMPatchWEB
sw.aveva.com/hubfs/assets-2018/pdf/security-bulletin/SecurityBulletin_LFSec126.pdfX Refsource MISCThird Party AdvisoryWEB
github.com/jquery/jquery/pull/2588/commits/c254d308a7d3f1eac4d0b42837804cfffcba4bb2X Refsource MISCPatchThird Party AdvisoryREPORTWEB
snyk.io/vuln/npm:jquery:20150627X Refsource MISCPatchThird Party AdvisoryREPORTWEB
github.com/jquery/jquery/pull/2588X Refsource MISCIssue TrackingPatchThird Party AdvisoryREPORTWEB
ics-cert.us-cert.gov/advisories/ICSA-18-212-04X Refsource MISCThird Party AdvisoryUS Government ResourceWEB
github.com/jquery/jquery/commit/f60729f3903d17917dc351f3ac87794de379b0ccX Refsource MISCPatchThird Party AdvisoryWEB
www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.htmlX Refsource MISCPatchWEB
packetstormsecurity.com/files/152787/dotCMS-5.1.1-Vulnerable-Dependencies.htmlX Refsource MISCWEB
packetstormsecurity.com/files/153237/RetireJS-CORS-Issue-Script-Execution.htmlX Refsource MISCWEB
www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.htmlX Refsource MISCWEB
www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.htmlX Refsource MISCWEB
www.tenable.com/security/tns-2019-08X Refsource CONFIRMWEB
www.oracle.com/security-alerts/cpujan2020.htmlX Refsource MISCWEB
packetstormsecurity.com/files/156743/OctoberCMS-Insecure-Dependencies.htmlX Refsource MISCWEB
www.oracle.com/security-alerts/cpuoct2020.htmlX Refsource MISCWEB
kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44601X Refsource CONFIRMWEB
security.netapp.com/advisory/ntap-20210108-0004/X Refsource CONFIRM
security.alpinelinux.org/vuln/CVE-2015-9251Advisory
ubuntu.com/security/CVE-2015-9251REPORT
www.cve.org/CVERecord?id=CVE-2015-9251REPORT
nvd.nist.gov/vuln/detail/CVE-2015-9251AdvisoryOval
github.com/jquery/jquery/issues/2432WEB
github.com/jquery/jquery/commit/b078a62013782c7424a4a61a240c23c4c0b42614WEB
security.netapp.com/advisory/ntap-20210108-0004WEB
security.snyk.io/vuln/SNYK-DOTNET-JQUERY-450227WEB
web.archive.org/web/20200227030101/http://www.securityfocus.com/bid/105658WEB
github.com/jquery/jqueryPACKAGE
github.com/rails/jquery-rails/blob/master/CHANGELOG.mdWEB
github.com/rails/jquery-rails/blob/v4.2.0/vendor/assets/javascripts/jquery3.jsWEB
github.com/rails/jquery-rails/releases/tag/v4.2.0WEB
github.com/rubysec/ruby-advisory-db/blob/master/gems/jquery-rails/CVE-2015-9251.ymlWEB
lists.apache.org/thread.html/…WEB
lists.apache.org/thread.html/…WEB
lists.apache.org/thread.html/…WEB
lists.apache.org/thread.html/…WEB
lists.apache.org/thread.html/…WEB
lists.apache.org/thread.html/…WEB
lists.apache.org/thread.html/…WEB
lists.apache.org/thread.html/…WEB