Vulnerability Name:

CVE-2011-4969 (CCN-82875)

Assigned:2011-12-23
Published:2013-01-30
Updated:2019-04-16
Summary:Cross-site scripting (XSS) vulnerability in jQuery before 1.6.3, when using location.hash to select elements, allows remote attackers to inject arbitrary web script or HTML via a crafted tag.
CVSS v3 Severity:5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): Low
Availibility (A): None
CVSS v2 Severity:4.3 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
3.7 Low (Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N/E:H/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Authentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): Partial
Availibility (A): None
4.3 Medium (CCN CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
3.7 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N/E:H/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Athentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): Partial
Availibility (A): None
Vulnerability Type:CWE-79
Vulnerability Consequences:Cross-Site Scripting
References:Source: CONFIRM
Type: UNKNOWN
http://blog.jquery.com/2011/09/01/jquery-1-6-3-released/

Source: MISC
Type: UNKNOWN
http://blog.mindedsecurity.com/2011/07/jquery-is-sink.html

Source: CONFIRM
Type: UNKNOWN
http://bugs.jquery.com/ticket/9521

Source: MITRE
Type: CNA
CVE-2011-4969

Source: CCN
Type: jQuery Web site
jQuery

Source: CCN
Type: oss-sec mailing list, Wed, 30 Jan 2013 21:00:58 -0700
jQuery 1.6.2 XSS CVE assignment

Source: MLIST
Type: UNKNOWN
[oss-security] 20130130 jQuery 1.6.2 XSS CVE assignment

Source: OSVDB
Type: UNKNOWN
80056

Source: CCN
Type: OSVDB ID: 80056
jQuery Tag Handling innerHTML DOM-based XSS

Source: BID
Type: UNKNOWN
58458

Source: CCN
Type: BID-58458
jQuery 'location.hash' Cross Site Scripting Vulnerability

Source: SECTRACK
Type: UNKNOWN
1036620

Source: UBUNTU
Type: UNKNOWN
USN-1722-1

Source: XF
Type: UNKNOWN
jquery-locationhash-xss(82875)

Source: CONFIRM
Type: Exploit, Patch
https://github.com/jquery/jquery/commit/db9e023e62c1ff5d8f21ed9868ab6878da2005e9

Source: CONFIRM
Type: UNKNOWN
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05111017

Source: CONFIRM
Type: UNKNOWN
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05158380

Source: CONFIRM
Type: UNKNOWN
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05232730

Source: MLIST
Type: UNKNOWN
[pulsar-commits] 20190416 [GitHub] [pulsar] one70six opened a new issue #4057: Security Vulnerabilities - Black Duck Scan - Pulsar v.2.3.1

Source: CONFIRM
Type: UNKNOWN
https://security.netapp.com/advisory/ntap-20190416-0007/

Source: CCN
Type: IBM Security Bulletin 6155493 (Business Process Manager Advanced)
Security vulnerabilities in Dojo and jQuery might affect IBM Business Automation Workflow and IBM Business Process Manager (BPM)

Source: CCN
Type: IBM Security Bulletin 6333027 (Security Identity Manager Virtual Appliance)
Multiple security vulnerabilities have been fixed in IBM Security Identity Manager Virtual Appliance

Source: CCN
Type: IBM Security Bulletin 6347588 (Security Guardium)
IBM Security Guardium is affected by multiple vulnerabilities

Source: CCN
Type: IBM Security Bulletin 6416391 (Spectrum Symphony)
Multiple vulnerability issues affect IBM Spectrum Symphony 7.3.1

Source: CCN
Type: IBM Security Bulletin 6449664 (QRadar SIEM)
IBM QRadar SIEM is vulnerable to using components with known vulnerabilities

Source: CCN
Type: IBM Security Bulletin 6830243 (QRadar User Behavior Analytics)
Multiple vulnerabilities in Spark affecting IBM QRadar User Behavior Analytics

Vulnerable Configuration:Configuration 1:
  • cpe:/a:jquery:jquery:1.6:*:*:*:*:*:*:*
  • OR cpe:/a:jquery:jquery:1.6.1:*:*:*:*:*:*:*
  • OR cpe:/a:jquery:jquery:*:*:*:*:*:*:*:* (Version <= 1.6.2)

  • Configuration CCN 1:
  • cpe:/a:jquery:jquery:1.6.2:*:*:*:*:*:*:*
  • AND
  • cpe:/a:ibm:business_process_manager:8.0:*:*:*:advanced:*:*:*
  • OR cpe:/a:ibm:business_process_manager:8.0.1:*:*:*:advanced:*:*:*
  • OR cpe:/a:ibm:business_process_manager:8.0.1.1:*:*:*:advanced:*:*:*
  • OR cpe:/a:ibm:business_process_manager:8.0.1.2:*:*:*:advanced:*:*:*
  • OR cpe:/a:ibm:business_process_manager:8.5:*:*:*:advanced:*:*:*
  • OR cpe:/a:ibm:business_process_manager:8.5.0.1:*:*:*:advanced:*:*:*
  • OR cpe:/a:ibm:business_process_manager:8.5.5:*:*:*:advanced:*:*:*
  • OR cpe:/a:ibm:business_process_manager:8.0.1.3:*:*:*:advanced:*:*:*
  • OR cpe:/a:ibm:business_process_manager:8.5.6:*:*:*:advanced:*:*:*
  • OR cpe:/a:ibm:business_process_manager:8.5.0.2:*:*:*:advanced:*:*:*
  • OR cpe:/a:ibm:business_process_manager:8.5.7:*:*:*:advanced:*:*:*
  • OR cpe:/a:ibm:business_process_manager:8.5.6.1:*:*:*:advanced:*:*:*
  • OR cpe:/a:ibm:business_process_manager:8.5.6.2:*:*:*:advanced:*:*:*
  • OR cpe:/a:ibm:qradar_security_information_and_event_manager:7.3:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:security_guardium:11.0:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:security_guardium:11.1:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:qradar_security_information_and_event_manager:7.4:-:*:*:*:*:*:*
  • OR cpe:/a:ibm:security_identity_manager_virtual_appliance:7.0.2:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:security_identity_manager_virtual_appliance:7.0.1:*:*:*:*:*:*:*

  • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.mitre.oval:def:18142
    P
    USN-1722-1 -- jquery vulnerability
    2014-06-30
    oval:com.ubuntu.precise:def:20114969000
    V
    CVE-2011-4969 on Ubuntu 12.04 LTS (precise) - medium.
    2013-03-08
    BACK
    jquery jquery 1.6
    jquery jquery 1.6.1
    jquery jquery *
    jquery jquery 1.6.2
    ibm business process manager 8.0
    ibm business process manager 8.0.1
    ibm business process manager 8.0.1.1
    ibm business process manager 8.0.1.2
    ibm business process manager 8.5
    ibm business process manager 8.5.0.1
    ibm business process manager 8.5.5
    ibm business process manager 8.0.1.3
    ibm business process manager 8.5.6
    ibm business process manager 8.5.0.2
    ibm business process manager 8.5.7
    ibm business process manager 8.5.6.1
    ibm business process manager 8.5.6.2
    ibm qradar security information and event manager 7.3
    ibm security guardium 11.0
    ibm security guardium 11.1
    ibm qradar security information and event manager 7.4 -
    ibm security identity manager virtual appliance 7.0.2
    ibm security identity manager virtual appliance 7.0.1