0

I've seen that in jQuery versions older than jQuery 3 there is the CVE-2015-9251 vulnerability which can result in cross-site scripting. Is this a limited vulnerability? What could be its possible effects? Should it be treated dangerous?

https://github.com/jquery/jquery/issues/2432

1

Is this a limited vulnerability?

It is limited in the sense that the vulnerability can only apply if your application is querying via $.get an untrusty/compromised website.

What could be its possible effects?

As per the CVE, your application would be vulnerable to XSS and all of its implications.

Should it be treated dangerous?

As much as any XSS execution in your application would be.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.