What is the CVSS score of CVE-2021-41183?

CVE-2021-41183 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 7.9%.

Is there a public PoC exploit available for CVE-2021-41183?

Yes, a public proof-of-concept exploit is available for CVE-2021-41183. Prioritise patching immediately. EPSS: 7.9%.

Is there a patch available for CVE-2021-41183?

Yes, a patch is available for CVE-2021-41183. Update the affected software to the latest version immediately.

Jquery Ui CVE-2021-41183

MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2021-10-26 security-advisories@github.com

XSS Jquery Ui Fedora H300s Firmware H500s Firmware H700s Firmware H300E Firmware H500E Firmware H700E Firmware H410s Firmware H410c Firmware Debian Linux Drupal Agile Plm Application Express Banking Platform Big Data Spatial And Graph Communications Interactive Session Recorder Communications Operations Monitor Hospitality Inventory Management Hospitality Suite8 Jd Edwards Enterpriseone Tools Mysql Enterprise Monitor Peoplesoft Enterprise Peopletools Policy Automation Primavera Gateway Rest Data Services Weblogic Server Tenable Sc

6.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

CVE Published

Oct 26, 2021 - 15:15 nvd

MEDIUM 6.1

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

13 npm packages depend on jquery-ui (6 direct, 7 indirect)

Ecosystem-wide dependent count for version 1.13.0.

DescriptionNVD

jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of various *Text options of the Datepicker widget from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. The values passed to various *Text options are now always treated as pure text, not HTML. A workaround is to not accept the value of the *Text options from untrusted sources.

AnalysisAI

jQuery-UI is the official jQuery user interface library. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.

Technical ContextAI

This vulnerability is classified as Cross-Site Scripting (XSS) (CWE-79), which allows attackers to inject malicious scripts into web pages viewed by other users. jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of various *Text options of the Datepicker widget from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. The values passed to various *Text options are now always treated as pure text, not HTML. A workaround is to not accept the value of the *Text options from untrusted sources. Affected products include: Jqueryui Jquery Ui, Fedoraproject Fedora, Netapp H300S Firmware, Netapp H500S Firmware, Netapp H700S Firmware. Version information: version 1.13.0.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Sanitize all user input, use Content-Security-Policy headers, encode output contextually (HTML, JS, URL). Use frameworks with built-in XSS protection.