jquery.mobile-1.4.5.min.js: 1 vulnerabilities (highest severity is: 6.5) - autoclosed

[mend-for-github-com[bot]]

Vulnerable Library - jquery.mobile-1.4.5.min.js

Touch-Optimized Web Framework for Smartphones & Tablets

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery-mobile/1.4.5/jquery.mobile.min.js

Path to dependency file: /release/src/router/www/sysdep/MAP-AC1750/www/QIS_wizard.htm

Path to vulnerable library: /release/src/router/www/sysdep/BLUECAVE/www/mobile/js/jquery.mobile.js,/release/src/router/www/sysdep/MAP-AC1750/www/js/jquery.mobile.js,/release/src/router/www/sysdep/MAP-AC1300/www/js/jquery.mobile.js,/release/src/router/www/sysdep/MAP-AC2200/www/js/jquery.mobile.js,/release/src/router/www/sysdep/VZW-AC1300/www/js/jquery.mobile.js,/release/src/router/www/sysdep/BLUECAVE/www/./mobile/js/jquery.mobile.js,/release/src/router/www/sysdep/MAP-AC1300/www/js/jquery.mobile.js

Found in HEAD commit: 0c45ce909374d16605095db4fce9a89b9b6bafd5

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in (jquery.mobile version)	Remediation Available
WS-2019-0136	Medium	6.5	jquery.mobile-1.4.5.min.js	Direct	BMC.NET - 1.0.3;org.webjars:jquery-mobile - 1.3.0-1,1.4.3;jquery.mobile - 1.3.0;jQWidgets_Framework - 8.0.0,6.0.6	❌

Details

WS-2019-0136

### Vulnerable Library - jquery.mobile-1.4.5.min.js

Touch-Optimized Web Framework for Smartphones & Tablets

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery-mobile/1.4.5/jquery.mobile.min.js

Path to dependency file: /release/src/router/www/sysdep/MAP-AC1750/www/QIS_wizard.htm

Path to vulnerable library: /release/src/router/www/sysdep/BLUECAVE/www/mobile/js/jquery.mobile.js,/release/src/router/www/sysdep/MAP-AC1750/www/js/jquery.mobile.js,/release/src/router/www/sysdep/MAP-AC1300/www/js/jquery.mobile.js,/release/src/router/www/sysdep/MAP-AC2200/www/js/jquery.mobile.js,/release/src/router/www/sysdep/VZW-AC1300/www/js/jquery.mobile.js,/release/src/router/www/sysdep/BLUECAVE/www/./mobile/js/jquery.mobile.js,/release/src/router/www/sysdep/MAP-AC1300/www/js/jquery.mobile.js

Dependency Hierarchy: - :x: **jquery.mobile-1.4.5.min.js** (Vulnerable Library)

Found in HEAD commit: 0c45ce909374d16605095db4fce9a89b9b6bafd5

Found in base branch: master

### Vulnerability Details

All versions of Jquery mobile have an open redirect that leads to cross-site scripting when the endpoint reflects user input.

Publish Date: 2019-06-13

URL: WS-2019-0136

### CVSS 3 Score Details (6.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: Required - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: None - Availability Impact: None

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/WS-2019-0136

Release Date: 2019-06-13

Fix Resolution: BMC.NET - 1.0.3;org.webjars:jquery-mobile - 1.3.0-1,1.4.3;jquery.mobile - 1.3.0;jQWidgets_Framework - 8.0.0,6.0.6

[mend-for-github-com[bot]]

:information_source: This issue was automatically closed by Mend because it is a duplicate of an existing issue: #28

[mend-for-github-com[bot]]

:information_source: This issue was automatically closed by Mend because it is a duplicate of an existing issue: #28