CVE-2015-9251

Aliases:GHSA-rmxg-73gg-4p98
Advisory lineage Upstream: 0 Downstream: 10
Modified
Published: 18 Jan 2018, 23:00
Last modified:06 Aug 2024, 08:43

Vulnerability Summary

Overall Risk (default)
medium
28/100
CVSS Score
6.1 MEDIUM
v3.0 (nvd)
EPSS Score
18.01% MEDIUM
18% probability -9.16%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

18 Jan 2018, 23:00
Published
Vulnerability first disclosed
06 Aug 2024, 08:43
Last Modified
Vulnerability information updated

Description

jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed.

CVSS Metrics

  • v3.0•MEDIUM•Score: 6.1CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
  • v2.0•MEDIUM•Score: 4.3AV:N/AC:M/Au:N/C:N/I:P/A:N

EPSS Trends

Current EPSS score: 18.01%• Percentile: 95%

Techniques & Countermeasures

  • CWE-79•Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

    The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Affected Systems

  • RubyGems•jquery-rails

    < 4.2.0

  • Unknown•JQuery

    < 3.0.0

  • org.webjars.npm•jquery

    < 1.12.2 | ≥ 1.12.3, < 3.0.0

  • Npm•jquery

    < 1.12.2 | ≥ 1.12.3, < 3.0.0

  • NuGet•jquery

    < 1.12.2 | ≥ 1.12.3, < 3.0.0

  • oracle•agile_product_lifecycle_management_for_process

    6.2.0.0 | 6.2.1.0 | 6.2.2.0 | 6.2.3.0 | 6.2.3.1

  • oracle•banking_platform

    2.6.0 | 2.6.1 | 2.6.2

  • oracle•business_process_management_suite

    11.1.1.9.0 | 12.1.3.0.0 | 12.2.1.3.0

  • oracle•communications_converged_application_server

    < 7.0.0.1

  • oracle•communications_interactive_session_recorder

    6.0 | 6.1 | 6.2

  • oracle•communications_services_gatekeeper

    < 6.1.0.4.0

  • oracle•communications_webrtc_session_controller

    < 7.2

  • oracle•endeca_information_discovery_studio

    3.1.0 | 3.2.0

  • oracle•enterprise_manager_ops_center

    12.2.2 | 12.3.3

  • oracle•enterprise_operations_monitor

    3.4 | 4.0

  • oracle•financial_services_analytical_applications_infrastructure

    ≥ 7.3.3, ≤ 7.3.5 | ≥ 8.0.0, ≤ 8.0.7

  • oracle•financial_services_asset_liability_management

    ≥ 8.0.4, ≤ 8.0.7

  • oracle•financial_services_data_integration_hub

    ≥ 8.0.5, ≤ 8.0.7

  • oracle•financial_services_funds_transfer_pricing

    ≥ 8.0.4, ≤ 8.0.7

  • oracle•financial_services_hedge_management_and_ifrs_valuations

    ≥ 8.0.4, ≤ 8.0.7

  • oracle•financial_services_liquidity_risk_management

    ≥ 8.0.2, ≤ 8.0.6

  • oracle•financial_services_loan_loss_forecasting_and_provisioning

    ≥ 8.0.2, ≤ 8.0.7

  • oracle•financial_services_market_risk_measurement_and_management

    8.0.5 | 8.0.6

  • oracle•financial_services_profitability_management

    ≥ 8.0.4, ≤ 8.0.6

  • oracle•financial_services_reconciliation_framework

    8.0.5 | 8.0.6

  • oracle•fusion_middleware_mapviewer

    12.2.1.3.0

  • oracle•healthcare_foundation

    7.1 | 7.2

  • oracle•healthcare_translational_research

    3.1.0

  • oracle•hospitality_cruise_fleet_management

    9.0.11

  • oracle•hospitality_guest_access

    4.2.0 | 4.2.1

  • oracle•hospitality_materials_control

    18.1

  • oracle•hospitality_reporting_and_analytics

    9.1.0

  • oracle•insurance_insbridge_rating_and_underwriting

    5.2 | 5.4 | 5.5

  • oracle•jd_edwards_enterpriseone_tools

    9.2

  • oracle•jdeveloper

    11.1.1.9.0 | 12.1.3.0.0 | 12.2.1.3.0

  • oracle•oss_support_tools

    19.1

  • oracle•peoplesoft_enterprise_peopletools

    8.55 | 8.56 | 8.57

  • oracle•primavera_gateway

    15.2 | 16.2 | 17.12

  • oracle•primavera_unifier

    ≥ 17.1, ≤ 17.12 | 16.1 | 16.2 | 18.8

  • oracle•real-time_scheduler

    2.3.0

  • oracle•retail_allocation

    15.0.2

  • oracle•retail_customer_insights

    15.0 | 16.0

  • oracle•retail_invoice_matching

    15.0

  • oracle•retail_sales_audit

    15.0

  • oracle•retail_workforce_management_software

    1.60.9 | 1.64.0

  • oracle•service_bus

    12.1.3.0.0 | 12.2.1.3.0

  • oracle•siebel_ui_framework

    18.10 | 18.11

  • oracle•utilities_framework

    ≥ 4.3.0.1, ≤ 4.3.0.4

  • oracle•utilities_mobile_workforce_management

    2.3.0

  • oracle•webcenter_sites

    11.1.1.8.0

Showing first 50 affected entries in server-rendered view.

References (57)