TI-2024-38631 Aliases GHSA-jrpw-8884-2747

eZ Platform Bundled jQuery affected by CVE-2019-11358

LOW 38Published 2024-05-15 · Updated 2024-05-15

Key facts

Attack vector: —
Privileges required: —
User interaction: —
Attack complexity: —
Impact type: —
Confidentiality · integrity · availability: —
Fix status: Fixed

No CVSS vector from any source. Fix status from GitHub.

Summary

In eZ Platform 2.x, ezsystems/ezplatform-admin-ui-assets before v4.2.0 includes jQuery version 3.3.1. This version of jQuery is affected by the security vulnerability https://www.cvedetails.com/cve/CVE-2019-11358/ This is fixed in jQuery version 3.4. We recommend that you upgrade your ezsystems/ezplatform-admin-ui-assets to v4.2.0 using Composer. This release includes jQuery 3.4.1.

Why it matters now

Fix Fixed ezsystems/ezplatform-admin-ui-assets (Packagist): 4.2.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	ezsystems/ezplatform-admin-ui-assets (Packagist)	4.0.0 to before 4.2.0	4.2.0	Patch available	GHSA-jrpw-8884-2747

ezsystems/ezplatform-admin-ui-assets (Packagist) Vendor— Affected 4.0.0 to before 4.2.0 Fixed in 4.2.0 Patch available GHSA-jrpw-8884-2747

Remediation

Fix · GHSA-jrpw-8884-2747 ezsystems/ezplatform-admin-ui-assets (Packagist) Fixed in 4.2.0 Advisory →

Timeline

2026-10-03 Threatist record created from GHSA-jrpw-8884-2747

References

Other 4

Sources

GHSA-jrpw-8884-2747 · GitHub Advisory Database · CC BY 4.0

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences