WS-2019-0136 (Medium) detected in jquery.mobile-1.4.0.js, jquery.mobile-1.4.0.min.js

[mend-bolt-for-github[bot]]

WS-2019-0136 - Medium Severity Vulnerability

Vulnerable Libraries - jquery.mobile-1.4.0.js, jquery.mobile-1.4.0.min.js

jquery.mobile-1.4.0.js

Touch-Optimized Web Framework for Smartphones & Tablets

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery-mobile/1.4.0/jquery.mobile.js

Path to vulnerable library: /framework/images/webapp/images/jquery/jquery.mobile/jquery.mobile-1.4.0.js

Dependency Hierarchy: - :x: **jquery.mobile-1.4.0.js** (Vulnerable Library)

jquery.mobile-1.4.0.min.js

Touch-Optimized Web Framework for Smartphones & Tablets

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery-mobile/1.4.0/jquery.mobile.min.js

Path to vulnerable library: /framework/images/webapp/images/jquery/jquery.mobile/jquery.mobile-1.4.0.min.js

Dependency Hierarchy: - :x: **jquery.mobile-1.4.0.min.js** (Vulnerable Library)

Found in HEAD commit: 9f6ed39589395d00f1d69228cb50a7987ba11512

Found in base branch: trunk

Vulnerability Details

All versions of Jquery mobile have an open redirect that leads to cross-site scripting when the endpoint reflects user input.

Publish Date: 2019-06-13

URL: WS-2019-0136

CVSS 3 Score Details (6.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: Required - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: None - Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/WS-2019-0136

Release Date: 2019-06-13

Fix Resolution: BMC.NET - 1.0.3;org.webjars:jquery-mobile - 1.3.0-1,1.4.3;jquery.mobile - 1.3.0;jQWidgets_Framework - 8.0.0,6.0.6

---

Step up your Open Source Security Game with Mend here