Details
-
Improvement
-
Status: Resolved
-
Major
-
Resolution: Fixed
-
3.3.0, 3.4.0
-
Reviewed
Description
UI2 uses an old jQuery version (2.1.4) which is affected by some known vulnerabilities, e.g.:
- https://nvd.nist.gov/vuln/detail/CVE-2020-11022#vulnCurrentDescriptionTitle
- https://nvd.nist.gov/vuln/detail/CVE-2020-11023#vulnCurrentDescriptionTitle
- https://www.exploit-db.com/exploits/49766
Attached an example reproduction page:
jquery.html
The alert window pops with 1.8.2, or 2.1.4 but not with a 3.6.0. However, I couldn't exploit this with UI2, but I haven't tried every code path for sure.
"jquery": "2.1.4", "jquery-ui": "1.11.4",
jQuery was upgraded already in hadoop-common:
jquery-ui should also be upgraded to at least 1.13.0:
Attachments
Attachments
Issue Links
- links to