jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed.

No CVSS v4.0

No CVSS v3.1

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

Access Vector Network

Access Complexity Medium

Authentication None

Confidentiality Impact None

Integrity Impact Partial

Availability Impact None

This CVE is not in the KEV list.

The EPSS score is 0.19968.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
n/a n/a affected
Version Status Constraints
n/a affected —

Configuration 1 [-]

cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*

Configuration 2 [-]

OR cpe:2.3:a:oracle:agile_product_lifecycle_management_for_process:6.2.0.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:agile_product_lifecycle_management_for_process:6.2.1.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:agile_product_lifecycle_management_for_process:6.2.2.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:agile_product_lifecycle_management_for_process:6.2.3.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:agile_product_lifecycle_management_for_process:6.2.3.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:banking_platform:2.6.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:banking_platform:2.6.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:banking_platform:2.6.2:*:*:*:*:*:*:*
cpe:2.3:a:oracle:business_process_management_suite:11.1.1.9.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:business_process_management_suite:12.1.3.0.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:business_process_management_suite:12.2.1.3.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_converged_application_server:*:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_interactive_session_recorder:6.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_interactive_session_recorder:6.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_interactive_session_recorder:6.2:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_services_gatekeeper:*:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_webrtc_session_controller:*:*:*:*:*:*:*:*
cpe:2.3:a:oracle:endeca_information_discovery_studio:3.1.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:endeca_information_discovery_studio:3.2.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:enterprise_manager_ops_center:12.2.2:*:*:*:*:*:*:*
cpe:2.3:a:oracle:enterprise_manager_ops_center:12.3.3:*:*:*:*:*:*:*
cpe:2.3:a:oracle:enterprise_operations_monitor:3.4:*:*:*:*:*:*:*
cpe:2.3:a:oracle:enterprise_operations_monitor:4.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:*:*:*:*:*:*:*:*
cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:*:*:*:*:*:*:*:*
cpe:2.3:a:oracle:financial_services_asset_liability_management:*:*:*:*:*:*:*:*
cpe:2.3:a:oracle:financial_services_data_integration_hub:*:*:*:*:*:*:*:*
cpe:2.3:a:oracle:financial_services_funds_transfer_pricing:*:*:*:*:*:*:*:*
cpe:2.3:a:oracle:financial_services_hedge_management_and_ifrs_valuations:*:*:*:*:*:*:*:*
cpe:2.3:a:oracle:financial_services_liquidity_risk_management:*:*:*:*:*:*:*:*
cpe:2.3:a:oracle:financial_services_loan_loss_forecasting_and_provisioning:*:*:*:*:*:*:*:*
cpe:2.3:a:oracle:financial_services_market_risk_measurement_and_management:8.0.5:*:*:*:*:*:*:*
cpe:2.3:a:oracle:financial_services_market_risk_measurement_and_management:8.0.6:*:*:*:*:*:*:*
cpe:2.3:a:oracle:financial_services_profitability_management:*:*:*:*:*:*:*:*
cpe:2.3:a:oracle:financial_services_reconciliation_framework:8.0.5:*:*:*:*:*:*:*
cpe:2.3:a:oracle:financial_services_reconciliation_framework:8.0.6:*:*:*:*:*:*:*
cpe:2.3:a:oracle:fusion_middleware_mapviewer:12.2.1.3.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:healthcare_foundation:7.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:healthcare_foundation:7.2:*:*:*:*:*:*:*
cpe:2.3:a:oracle:healthcare_translational_research:3.1.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:hospitality_cruise_fleet_management:9.0.11:*:*:*:*:*:*:*
cpe:2.3:a:oracle:hospitality_guest_access:4.2.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:hospitality_guest_access:4.2.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:hospitality_materials_control:18.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:hospitality_reporting_and_analytics:9.1.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:insurance_insbridge_rating_and_underwriting:5.2:*:*:*:*:*:*:*
cpe:2.3:a:oracle:insurance_insbridge_rating_and_underwriting:5.4:*:*:*:*:*:*:*
cpe:2.3:a:oracle:insurance_insbridge_rating_and_underwriting:5.5:*:*:*:*:*:*:*
cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:9.2:*:*:*:*:*:*:*
cpe:2.3:a:oracle:jdeveloper:11.1.1.9.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:jdeveloper:12.1.3.0.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:jdeveloper:12.2.1.3.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:oss_support_tools:19.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.55:*:*:*:*:*:*:*
cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.56:*:*:*:*:*:*:*
cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.57:*:*:*:*:*:*:*
cpe:2.3:a:oracle:primavera_gateway:15.2:*:*:*:*:*:*:*
cpe:2.3:a:oracle:primavera_gateway:16.2:*:*:*:*:*:*:*
cpe:2.3:a:oracle:primavera_gateway:17.12:*:*:*:*:*:*:*
cpe:2.3:a:oracle:primavera_unifier:*:*:*:*:*:*:*:*
cpe:2.3:a:oracle:primavera_unifier:16.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:primavera_unifier:16.2:*:*:*:*:*:*:*
cpe:2.3:a:oracle:primavera_unifier:18.8:*:*:*:*:*:*:*
cpe:2.3:a:oracle:real-time_scheduler:2.3.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:retail_allocation:15.0.2:*:*:*:*:*:*:*
cpe:2.3:a:oracle:retail_customer_insights:15.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:retail_customer_insights:16.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:retail_invoice_matching:15.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:retail_sales_audit:15.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:retail_workforce_management_software:1.60.9:*:*:*:*:*:*:*
cpe:2.3:a:oracle:retail_workforce_management_software:1.64.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:service_bus:12.1.3.0.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:service_bus:12.2.1.3.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:siebel_ui_framework:18.10:*:*:*:*:*:*:*
cpe:2.3:a:oracle:siebel_ui_framework:18.11:*:*:*:*:*:*:*
cpe:2.3:a:oracle:utilities_framework:*:*:*:*:*:*:*:*
cpe:2.3:a:oracle:utilities_mobile_workforce_management:2.3.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:webcenter_sites:11.1.1.8.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:weblogic_server:12.1.3.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:weblogic_server:12.2.1.3:*:*:*:*:*:*:*
Package CPE Advisory Released Date
Red Hat Data Grid 7.3.5
jquery cpe:/a:redhat:jboss_data_grid:7.3 RHSA-2020:0729 2020-03-05T00:00:00Z
Red Hat Enterprise Linux 7
ipa-0:4.6.8-5.el7 cpe:/o:redhat:enterprise_linux:7 RHSA-2020:3936 2020-09-29T00:00:00Z
Red Hat Enterprise Linux 8
idm:client-8030020200923172426.05ac3f11 cpe:/a:redhat:enterprise_linux:8 RHSA-2020:4670 2020-11-04T00:00:00Z
idm:DL1-8030020200923172343.9c827e52 cpe:/a:redhat:enterprise_linux:8 RHSA-2020:4670 2020-11-04T00:00:00Z
pki-core:10.6-8030020200911215836.5ff1562f cpe:/a:redhat:enterprise_linux:8 RHSA-2020:4847 2020-11-04T00:00:00Z
pki-deps:10.6-8030020200527165326.30b713e6 cpe:/a:redhat:enterprise_linux:8 RHSA-2020:4847 2020-11-04T00:00:00Z
Red Hat Fuse 6.3
jquery cpe:/a:redhat:jboss_fuse:6.3 RHSA-2020:0481 2020-02-12T00:00:00Z
Red Hat Fuse 7.6.0
jquery cpe:/a:redhat:jboss_fuse:7 RHSA-2020:0983 2020-03-26T00:00:00Z
Red Hat JBoss Enterprise Application Platform 7
jquery cpe:/a:redhat:jboss_enterprise_application_platform:7.4 RHSA-2023:0556 2023-01-31T00:00:00Z
Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8
eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el8eap cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8 RHSA-2023:0553 2023-01-31T00:00:00Z
Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9
eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el9eap cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9 RHSA-2023:0554 2023-01-31T00:00:00Z
Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7
eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7 RHSA-2023:0552 2023-01-31T00:00:00Z

No data.

Project Subscriptions

Vendors Products
Jquery Subscribe
Jquery Subscribe
Oracle Subscribe
Agile Product Lifecycle Management For Process Subscribe
Banking Platform Subscribe
Business Process Management Suite Subscribe
Communications Converged Application Server Subscribe
Communications Interactive Session Recorder Subscribe
Communications Services Gatekeeper Subscribe
Communications Webrtc Session Controller Subscribe
Endeca Information Discovery Studio Subscribe
Enterprise Manager Ops Center Subscribe
Enterprise Operations Monitor Subscribe
Financial Services Analytical Applications Infrastructure Subscribe
Financial Services Asset Liability Management Subscribe
Financial Services Data Integration Hub Subscribe
Financial Services Funds Transfer Pricing Subscribe
Financial Services Hedge Management And Ifrs Valuations Subscribe
Financial Services Liquidity Risk Management Subscribe
Financial Services Loan Loss Forecasting And Provisioning Subscribe
Financial Services Market Risk Measurement And Management Subscribe
Financial Services Profitability Management Subscribe
Financial Services Reconciliation Framework Subscribe
Fusion Middleware Mapviewer Subscribe
Healthcare Foundation Subscribe
Healthcare Translational Research Subscribe
Hospitality Cruise Fleet Management Subscribe
Hospitality Guest Access Subscribe
Hospitality Materials Control Subscribe
Hospitality Reporting And Analytics Subscribe
Insurance Insbridge Rating And Underwriting Subscribe
Jd Edwards Enterpriseone Tools Subscribe
Jdeveloper Subscribe
Oss Support Tools Subscribe
Peoplesoft Enterprise Peopletools Subscribe
Primavera Gateway Subscribe
Primavera Unifier Subscribe
Real-time Scheduler Subscribe
Retail Allocation Subscribe
Retail Customer Insights Subscribe
Retail Invoice Matching Subscribe
Retail Sales Audit Subscribe
Retail Workforce Management Software Subscribe
Service Bus Subscribe
Siebel Ui Framework Subscribe
Utilities Framework Subscribe
Utilities Mobile Workforce Management Subscribe
Webcenter Sites Subscribe
Weblogic Server Subscribe
Redhat Subscribe
Enterprise Linux Subscribe
Jboss Data Grid Subscribe
Jboss Enterprise Application Platform Subscribe
Jboss Fuse Subscribe
Advisories
Source ID Title
Github GHSA Github GHSA GHSA-rmxg-73gg-4p98 Cross-Site Scripting (XSS) in jquery
Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00041.html cve-icon cve-icon
http://packetstormsecurity.com/files/152787/dotCMS-5.1.1-Vulnerable-Dependencies.html cve-icon cve-icon
http://packetstormsecurity.com/files/153237/RetireJS-CORS-Issue-Script-Execution.html cve-icon cve-icon
http://packetstormsecurity.com/files/156743/OctoberCMS-Insecure-Dependencies.html cve-icon cve-icon
http://seclists.org/fulldisclosure/2019/May/10 cve-icon cve-icon
http://seclists.org/fulldisclosure/2019/May/11 cve-icon cve-icon
http://seclists.org/fulldisclosure/2019/May/13 cve-icon cve-icon
http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html cve-icon cve-icon
http://www.securityfocus.com/bid/105658 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2020:0481 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2020:0729 cve-icon cve-icon
https://github.com/jquery/jquery/commit/f60729f3903d17917dc351f3ac87794de379b0cc cve-icon cve-icon
https://github.com/jquery/jquery/issues/2432 cve-icon cve-icon
https://github.com/jquery/jquery/pull/2588 cve-icon cve-icon
https://github.com/jquery/jquery/pull/2588/commits/c254d308a7d3f1eac4d0b42837804cfffcba4bb2 cve-icon cve-icon
https://ics-cert.us-cert.gov/advisories/ICSA-18-212-04 cve-icon cve-icon
https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44601 cve-icon cve-icon
https://lists.apache.org/thread.html/10f0f3aefd51444d1198c65f44ffdf2d78ca3359423dbc1c168c9731%40%3Cdev.flink.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/17ff53f7999e74fbe3cc0ceb4e1c3b00b180b7c5afec8e978837bc49%40%3Cuser.flink.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/52bafac05ad174000ea465fe275fd3cc7bd5c25535a7631c0bc9bfb2%40%3Cuser.flink.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/54df3aeb4239b64b50b356f0ca6f986e3c4ca5b84c515dce077c7854%40%3Cuser.flink.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/ba79cf1658741e9f146e4c59b50aee56656ea95d841d358d006c18b6%40%3Ccommits.roller.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E cve-icon cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2015-9251 cve-icon
https://seclists.org/bugtraq/2019/May/18 cve-icon cve-icon
https://security.netapp.com/advisory/ntap-20210108-0004/ cve-icon cve-icon
https://snyk.io/vuln/npm:jquery:20150627 cve-icon cve-icon
https://sw.aveva.com/hubfs/assets-2018/pdf/security-bulletin/SecurityBulletin_LFSec126.pdf cve-icon cve-icon
https://www.cve.org/CVERecord?id=CVE-2015-9251 cve-icon
https://www.oracle.com/security-alerts/cpuapr2020.html cve-icon cve-icon
https://www.oracle.com/security-alerts/cpujan2020.html cve-icon cve-icon
https://www.oracle.com/security-alerts/cpujul2020.html cve-icon cve-icon
https://www.oracle.com/security-alerts/cpuoct2020.html cve-icon cve-icon
https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html cve-icon cve-icon
https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html cve-icon cve-icon
https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html cve-icon cve-icon
https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html cve-icon cve-icon
https://www.tenable.com/security/tns-2019-08 cve-icon cve-icon
History

No history.

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published:

Updated: 2024-08-06T08:43:41.697Z

Reserved: 2018-01-18T00:00:00

Link: CVE-2015-9251

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Modified

Published: 2018-01-18T23:29:00.307

Modified: 2024-11-21T02:40:09.093

Link: CVE-2015-9251

cve-icon Redhat

Severity : Moderate

Publid Date: 2015-06-27T00:00:00Z

Links: CVE-2015-9251 - Bugzilla

cve-icon OpenCVE Enrichment

No data.

Weaknesses