Cross-site scripting in jQuery - CVE-2015-9251

Vulnerability identifier: #VU14150

CSH Severity: Low

CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]

CVE-ID: CVE-2015-9251

CWE-ID: CWE-79

Exploitation vector: Remote access

Exploit availability: No public exploit available

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data when a cross-domain Ajax request is performed without the dataType option. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary text/javascript responses in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

jQuery
watsonx.data
PT-G503
Arch Linux
Amazon Linux AMI
Red Hat Enterprise Linux for Power, big endian
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for x86_64
Opensuse
Fedora
IBM Cloud Pak for Watson AIOps
IBM Watson Machine Learning Accelerator
Tivoli Network Manager IP Edition
Oracle Utilities Framework
Oracle Agile Product Lifecycle Management for Process
Oracle Business Intelligence Enterprise Edition
Oracle Retail Customer Insights
Storage Copy Data Management
MobileFirst Platform
Robotic Process Automation for Cloud Pak
InTouch Access Anywhere
IBM Process Mining
IBM Cloud Transformation Advisor
Oracle Communications Application Session Controller
JBoss A-MQ
WebSphere eXtreme Scale
QRadar User Behavior Analytics
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
Data Replication on Cloud Pak for Data
Engineering Workflow Management
Oracle Communications WebRTC Session Controller
IBM Maximo Asset Management
IBM Security Verify Governance
IBM Cloud Pak for Business Automation
Oracle Retail Workforce Management Software
Cloudera Data Platform Private Cloud Base for IBM
Oracle Knowledge
Oracle Business Process Management Suite
ruby (Alpine package)
rabbitmq-server (Alpine package)
ipa (Red Hat package)
eap7-jboss-jsp (Red Hat package)
eap7-jboss-jsf (Red Hat package)
eap7-javaee-security-soteria (Red Hat package)
eap7-jettison (Red Hat package)
eap7-ironjacamar (Red Hat package)
eap7-elytron-web (Red Hat package)
eap7-jboss-server-migration (Red Hat package)
python-XStatic-jquery-ui
eap7-wildfly-elytron (Red Hat package)
eap7-undertow (Red Hat package)
eap7-apache-sshd (Red Hat package)
eap7-jackson-annotations (Red Hat package)
eap7-jackson-core (Red Hat package)
eap7-jackson-databind (Red Hat package)
eap7-jackson-jaxrs-providers (Red Hat package)
eap7-jackson-modules-java8 (Red Hat package)
eap7-jackson-modules-base (Red Hat package)
eap7-hal-console (Red Hat package)
eap7-jboss-ejb-client (Red Hat package)
eap7-jboss-remoting (Red Hat package)
eap7-hibernate-search (Red Hat package)
eap7-woodstox-core (Red Hat package)
eap7-wildfly (Red Hat package)
Diagnostic Assistant
Traffix SDC
Primavera Unifier
IBM Tivoli Network Manager (ITNM)
Oracle Insurance Insbridge Rating and Underwriting
IBM Qradar SIEM
JBoss Data Grid
IBM Cognos Command Center
Fuse
JBoss Enterprise Application Platform
Oracle WebLogic Server
Oracle Communications Converged Application Server
Oracle Healthcare Foundation
Oracle Retail Sales Audit
Juniper Secure Analytics (JSA)
PeopleSoft Enterprise PeopleTools
Oracle Enterprise Manager Ops Center
IBM Storage Scale System
Dell Storage Manager
IBM CICS TX Standard
IBM CICS TX Advanced
IBM InfoSphere Information Server

Install update from vendor's website.

jQuery - addressed in versions 1.12.2, 2.2.2, 3.0.0
PT-G503 - update to 5.3
IBM Process Mining - update to 1.12.0.4
IBM Cloud Transformation Advisor - update to 3.1.0
IBM Watson Machine Learning Accelerator - update to 2.6.0
ruby (Alpine package) - update to 2.5.7-r0
Diagnostic Assistant - update to 2.12.36
rabbitmq-server (Alpine package) - update to 3.7.17-r0
ipa (Red Hat package) - update to 4.6.8-5.el7
Tivoli Network Manager IP Edition - update to 4.2.0.20
Fuse - addressed in versions 6.3.15, 7.6.0
Cloudera Data Platform Private Cloud Base for IBM - addressed in versions 7.1.7 SP3, 7.1.9 SP1
IBM Qradar SIEM - addressed in versions 7.3.3 Fix Pack 9, 7.4.3 Fix Pack 1
JBoss Enterprise Application Platform - update to 7.4.9
Juniper Secure Analytics (JSA) - update to 7.5.0 UP8 IF03
WebSphere eXtreme Scale - update to 8.6.1.5 PH53340
eap7-jboss-jsp (Red Hat package) - addressed in versions api_2.3_spec-2.0.0-3.Final_redhat_00001.1.el7eap, api_2.3_spec-2.0.0-3.Final_redhat_00001.1.el8eap, api_2.3_spec-2.0.0-3.Final_redhat_00001.1.el9eap
eap7-jboss-jsf (Red Hat package) - addressed in versions api_2.3_spec-3.0.0-6.SP07_redhat_00001.1.el7eap, api_2.3_spec-3.0.0-6.SP07_redhat_00001.1.el8eap, api_2.3_spec-3.0.0-6.SP07_redhat_00001.1.el9eap
eap7-javaee-security-soteria (Red Hat package) - addressed in versions 1.0.1-3.redhat_00003.1.el7eap, 1.0.1-3.redhat_00003.1.el8eap, 1.0.1-3.redhat_00003.1.el9eap
eap7-jettison (Red Hat package) - addressed in versions 1.5.2-1.redhat_00002.1.el7eap, 1.5.2-1.redhat_00002.1.el8eap, 1.5.2-1.redhat_00002.1.el9eap
eap7-ironjacamar (Red Hat package) - addressed in versions 1.5.10-1.Final_redhat_00001.1.el7eap, 1.5.10-1.Final_redhat_00001.1.el8eap, 1.5.10-1.Final_redhat_00001.1.el9eap
eap7-elytron-web (Red Hat package) - addressed in versions 1.9.3-1.Final_redhat_00001.1.el7eap, 1.9.3-1.Final_redhat_00001.1.el8eap, 1.9.3-1.Final_redhat_00001.1.el9eap
eap7-jboss-server-migration (Red Hat package) - addressed in versions 1.10.0-24.Final_redhat_00023.1.el7eap, 1.10.0-24.Final_redhat_00023.1.el8eap, 1.10.0-24.Final_redhat_00023.1.el9eap
python-XStatic-jquery-ui - update to 1.12.0.1-2.fc27
eap7-wildfly-elytron (Red Hat package) - addressed in versions 1.15.16-1.Final_redhat_00001.1.el7eap, 1.15.16-1.Final_redhat_00001.1.el8eap, 1.15.16-1.Final_redhat_00001.1.el9eap
watsonx.data - update to 2.1
eap7-undertow (Red Hat package) - addressed in versions 2.2.22-1.SP3_redhat_00001.1.el7eap, 2.2.22-1.SP3_redhat_00001.1.el8eap, 2.2.22-1.SP3_redhat_00001.1.el9eap
Storage Copy Data Management - update to 2.2.26.0
eap7-apache-sshd (Red Hat package) - addressed in versions 2.9.2-1.redhat_00001.1.el7eap, 2.9.2-1.redhat_00001.1.el8eap, 2.9.2-1.redhat_00001.1.el9eap
eap7-jackson-annotations (Red Hat package) - addressed in versions 2.12.7-1.redhat_00003.1.el7eap, 2.12.7-1.redhat_00003.1.el8eap, 2.12.7-1.redhat_00003.1.el9eap
eap7-jackson-core (Red Hat package) - addressed in versions 2.12.7-1.redhat_00003.1.el7eap, 2.12.7-1.redhat_00003.1.el8eap, 2.12.7-1.redhat_00003.1.el9eap
eap7-jackson-databind (Red Hat package) - addressed in versions 2.12.7-1.redhat_00003.1.el7eap, 2.12.7-1.redhat_00003.1.el8eap, 2.12.7-1.redhat_00003.1.el9eap
eap7-jackson-jaxrs-providers (Red Hat package) - addressed in versions 2.12.7-1.redhat_00003.1.el7eap, 2.12.7-1.redhat_00003.1.el8eap, 2.12.7-1.redhat_00003.1.el9eap
eap7-jackson-modules-java8 (Red Hat package) - addressed in versions 2.12.7-1.redhat_00003.1.el7eap, 2.12.7-1.redhat_00003.1.el8eap, 2.12.7-1.redhat_00003.1.el9eap
eap7-jackson-modules-base (Red Hat package) - addressed in versions 2.12.7-1.redhat_00003.1.el7eap, 2.12.7-1.redhat_00003.1.el8eap, 2.12.7-1.redhat_00003.1.el9eap
eap7-hal-console (Red Hat package) - addressed in versions 3.3.16-1.Final_redhat_00001.1.el7eap, 3.3.16-1.Final_redhat_00001.1.el8eap, 3.3.16-1.Final_redhat_00001.1.el9eap
eap7-jboss-ejb-client (Red Hat package) - addressed in versions 4.0.49-1.Final_redhat_00001.1.el7eap, 4.0.49-1.Final_redhat_00001.1.el8eap, 4.0.49-1.Final_redhat_00001.1.el9eap
QRadar User Behavior Analytics - update to 4.1.9
IBM Tivoli Network Manager (ITNM) - update to 4.2.0.16
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data - update to 4.5.1
eap7-jboss-remoting (Red Hat package) - addressed in versions 5.0.27-1.Final_redhat_00001.1.el7eap, 5.0.27-1.Final_redhat_00001.1.el8eap, 5.0.27-1.Final_redhat_00001.1.el9eap
Data Replication on Cloud Pak for Data - update to 5.1.0
IBM Storage Scale System - addressed in versions 5.2.0.0, 6.1.9.2
eap7-hibernate-search (Red Hat package) - addressed in versions 5.10.13-3.Final_redhat_00001.1.el7eap, 5.10.13-3.Final_redhat_00001.1.el8eap, 5.10.13-3.Final_redhat_00001.1.el9eap
eap7-woodstox-core (Red Hat package) - addressed in versions 6.4.0-1.redhat_00001.1.el7eap, 6.4.0-1.redhat_00001.1.el8eap, 6.4.0-1.redhat_00001.1.el9eap
Oracle Communications Converged Application Server - update to 7.0.0.1
Engineering Workflow Management - addressed in versions 7.0.1 iFix021, 7.0.2 iFix021
Oracle Communications WebRTC Session Controller - update to 7.2
JBoss Data Grid - update to 7.3.5
eap7-wildfly (Red Hat package) - addressed in versions 7.4.9-4.GA_redhat_00003.1.el7eap, 7.4.9-4.GA_redhat_00003.1.el8eap, 7.4.9-4.GA_redhat_00003.1.el9eap
IBM Maximo Asset Management - update to 7.6.1.2.37
MobileFirst Platform - update to 8.0.0.0-MFPF-IF202304111626
IBM Security Verify Governance - update to 10.0.2.0.1
IBM Cognos Command Center - update to 10.2.4 Fix Pack 1 IF17
IBM CICS TX Standard - update to 11.1.0.0 ifix5
IBM CICS TX Advanced - update to 11.1.0.0 ifix5
IBM InfoSphere Information Server - update to 11.7.1.4 Service pack 1
IBM Cloud Pak for Business Automation - addressed in versions 21.0.3.24, 23.0.1.2
Robotic Process Automation for Cloud Pak - addressed in versions 21.0.7.10, 23.0.10
Dell Storage Manager - update to 2020 R1.21

• https://github.com/jquery/jquery/commit/f60729f3903d17917dc351f3ac87794de379b0cc
• https://github.com/jquery/jquery/issues/2432
• https://github.com/jquery/jquery/pull/2588
• https://github.com/jquery/jquery/pull/2588/commits/c254d308a7d3f1eac4d0b42837804cfffcba4bb2

• Cross-site scripting in AVEVA InTouch Access Anywhere
• Multiple vulnerabilities in Oracle Insurance Applications
• Arch Linux update for ruby-rdoc
• Multiple vulnerabilities in Red Hat JBoss Fuse and A-MQ
• XSS vulnerability in bundled jQuery library in F5 Networks Traffix SDC WebUI
• Cross-site scripting in jQuery
• Multiple vulnerabilities in Red Hat Fuse
• OpenSUSE update for ruby
• Multiple vulnerabilities in Oracle Knowledge
• Multiple vulnerabilities in Oracle WebLogic Server
• Cross-site scripting in rabbitmq-server (Alpine package)
• Cross-site scripting in ruby (Alpine package)
• Amazon Linux AMI update for ruby24
• Red Hat Enterprise Linux 7 update for ipa
• Red Hat Enterprise Linux 8 update for the idm:DL1 and idm:client modules
• Multiple vulnerabilities in IBM QRadar SIEM
• Multiple vulnerabilities in IBM Tivoli Network Manager
• Cross-site scripting in IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform 7.4
• Multiple vulnerabilities in JBoss Enterprise Application Platform 7.4 for RHEL 7
• Multiple vulnerabilities in JBoss Enterprise Application Platform 7.4 for RHEL 8
• Multiple vulnerabilities in JBoss Enterprise Application Platform 7.4 for RHEL 9
• Multiple vulnerabilities in IBM Process Mining
• Multiple vulnerabilities in IBM CICS TX Advanced
• Multiple vulnerabilities in IBM CICS TX Standard
• Multiple vulnerabilities in IBM WebSphere eXtreme Scale Liberty Deployment
• Multiple vulnerabilities in IBM MobileFirst Platform
• Multiple vulnerabilities in IBM Engineering Workflow Management (EWM)
• Multiple vulnerabilities in IBM Cognos Command Center
• Multiple vulnerabilities in IBM Cloud Transformation Advisor
• Multiple vulnerabilities in IBM InfoSphere Information Server
• Multiple vulnerabilities in IBM Cloud Pak for Business Automation
• Multiple vulnerabilities in IBM Robotic Process Automation for Cloud Pak
• Multiple vulnerabilities in IBM Cloud Pak for Watson AIOps
• Multiple vulnerabilities in IBM Maximo Asset Management
• Multiple vulnerabilities in Moxa PT-G503 Series
• Watson Machine Learning Accelerator on Cloud Pak for Data update for jQuery
• Multiple vulnerabilities in IBM Security Verify Governance
• Multiple vulnerabilities in IBM Storage Scale
• Multiple vulnerabilities in Juniper Secure Analytics (JSA)
• Multiple vulnerabilities in IBM Tivoli Network Manager IP Edition (ITNM)
• Multiple vulnerabilities in IBM QRadar User Behavior Analytics
• Multiple vulnerabilities in IBM watsonx.data
• Multiple vulnerabilities in IBM Data Replication on Cloud Pak for Data
• Fedora 27 update for python-XStatic-jquery-ui
• Multiple vulnerabilities in JBoss Data Grid 7.3
• Multiple vulnerabilities in IBM Storage Copy Data Management
• Multiple vulnerabilities in Dell Storage Manager
• Multiple vulnerabilities in Primavera Unifier
• Multiple vulnerabilities in Oracle Communications Application Session Controller
• Cross-site scripting in Oracle Business Intelligence Enterprise Edition
• Cross-site scripting in Diagnostic Assistant
• Multiple vulnerabilities in Cloudera Data Platform Private Cloud Base with IBM (CDP)
• Cross-site scripting in Oracle Utilities Framework
• Cross-site scripting in Oracle Agile Product Lifecycle Management for Process
• Cross-site scripting in Oracle Retail Sales Audit
• Cross-site scripting in Oracle Retail Workforce Management Software
• Multiple vulnerabilities in Oracle Retail Customer Insights
• Multiple vulnerabilities in PeopleSoft Enterprise PeopleTools
• Cross-site scripting in Oracle Healthcare Foundation
• Cross-site scripting in Oracle Insurance Insbridge Rating and Underwriting
• Multiple vulnerabilities in Oracle Business Process Management Suite
• Multiple vulnerabilities in Oracle WebLogic Server
• Multiple vulnerabilities in Oracle Enterprise Manager Ops Center
• Multiple vulnerabilities in Oracle Communications Converged Application Server
• Multiple vulnerabilities in Oracle Communications WebRTC Session Controller