What is the CVSS score of CVE-2021-41182?

CVE-2021-41182 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 42.2%.

Is there a public PoC exploit available for CVE-2021-41182?

Yes, a public proof-of-concept exploit is available for CVE-2021-41182. Prioritise patching immediately. EPSS: 42.2%.

Is there a patch available for CVE-2021-41182?

Yes, a patch is available for CVE-2021-41182. Update the affected software to the latest version immediately.

Jquery Ui CVE-2021-41182

MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2021-10-26 security-advisories@github.com

XSS Jquery Ui Fedora H500s Firmware H700s Firmware H300E Firmware H500E Firmware H700E Firmware H410s Firmware H410c Firmware H300s Firmware Debian Linux Drupal Communications Interactive Session Recorder Communications Operations Monitor Hospitality Suite8 Mysql Enterprise Monitor Primavera Unifier Weblogic Server Tenable Sc Agile Plm Application Express Banking Platform Big Data Spatial And Graph Hospitality Inventory Management Hospitality Materials Control Jd Edwards Enterpriseone Tools Peoplesoft Enterprise Peopletools Policy Automation Rest Data Services

6.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

CVE Published

Oct 26, 2021 - 15:15 nvd

MEDIUM 6.1

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

13 npm packages depend on jquery-ui (6 direct, 7 indirect)

Ecosystem-wide dependent count for version 1.13.0.

DescriptionNVD

jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the altField option of the Datepicker widget from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. Any string value passed to the altField option is now treated as a CSS selector. A workaround is to not accept the value of the altField option from untrusted sources.

AnalysisAI

jQuery-UI is the official jQuery user interface library. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.

Technical ContextAI

This vulnerability is classified as Cross-Site Scripting (XSS) (CWE-79), which allows attackers to inject malicious scripts into web pages viewed by other users. jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the altField option of the Datepicker widget from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. Any string value passed to the altField option is now treated as a CSS selector. A workaround is to not accept the value of the altField option from untrusted sources. Affected products include: Jqueryui Jquery Ui, Fedoraproject Fedora, Netapp H500S Firmware, Netapp H700S Firmware, Netapp H300E Firmware. Version information: version 1.13.0.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Sanitize all user input, use Content-Security-Policy headers, encode output contextually (HTML, JS, URL). Use frameworks with built-in XSS protection.