search

joeferner / redis-commander

Redis management tool written in node.js
http://joeferner.github.io/redis-commander/
MIT License
3.56k stars 460 forks source link

JQuery Vulnerability #528

Closed carellevbt closed 1 year ago

carellevbt commented 1 year ago

Hello, The current application uses JQuery 2.2.4. However, we have several vulnerabilities tied to this and the fix is to upgrade to version 3.5 or later. When we update to 3.5. it breaks the application. Would you please advise on how to proceed with this?

sseide commented 1 year ago

The app uses Bootstrap 2.3, therefore incompatible with jQuery 3. An bootstrap update is needed but no-one found time so far. Best / fastest way is to provide an PR to replace old Bootstrap - this is very welcome.

Other possibility is to restrict access with HTTP Authentication, so only the very limited group of people allowed to use Redis Commander can access the files to limit the risk using the older jQuery version.

carellevbt commented 1 year ago

Hello, access has already been restricted with HTTP authentication. I will create a pull request. Thank you very much