[MSKINS-203] CVEs in generated maven site with maven-fluido-skin

• Type: Bug
• Status: Closed
• Priority: Critical
• Resolution: Duplicate
• Affects Version/s: fluido-1.11.1
• Component/s: Fluido Skin
• Assignee: Unassigned
• Reporter: jycr
• Created: 06/Jan/23 11:57
• Updated: 09/Jan/23 00:36
• Resolved: 07/Jan/23 09:31

Description

Generated Maven site (with maven-fluido-skin) are affected by following CVEs:

• CVE-2015-9251
• CVE-2019-11358
• CVE-2020-11022
• CVE-2020-11023

Those CVEs are regarding jQuery version used by this skin: jQuery 1.11.2

An upgrade of jQuery is needed to use jQuery version >= 3.5.0

Unfortunately, Bootstrap 2.3.2 does not support jQuery 3+

An upgrade of Bootstrap is needed to use Bootstrap version >= 3.3.7

Some modifications is needed, see: https://getbootstrap.com/docs/3.4/migration/

Please note: Bootstrap 2 is under Apache License, Bootstrap 3 is under MIT License

Issue Links

• duplicates: MSKINS-175 Upgrade to JQuery 3.6.0 in Fluido skin
• is related to: MSKINS-175 Upgrade to JQuery 3.6.0 in Fluido skin
• is related to: MSKINS-97 Upgrade to Bootstrap 5.x