Vulnerable embedded jQuery Version
Key facts
- Attack vector
- —
- Privileges required
- —
- User interaction
- —
- Attack complexity
- —
- Impact type
- —
- Confidentiality · integrity · availability
- —
- Fix status
- Fixed
No CVSS vector from any source. Fix status from GitHub.
Summary
### Summary PIMCore uses the JavaScript library jQuery in version 3.4.1. This version is vulnerable to cross-site-scripting (XSS). ### Details In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing elements from untrusted sources - even after sanitizing it to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0. Publish Date: 2020-04-29 URL:= https://security.snyk.io/package/npm/jquery/3.4.1
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | pimcore/admin-ui-classic-bundle (Packagist) | before 1.4.3 | 1.4.3 | Patch available | GHSA-jmh9-6rjq-gjh9 |
- pimcore/admin-ui-classic-bundle (Packagist) Vendor— Affected before 1.4.3 Fixed in 1.4.3 Patch available GHSA-jmh9-6rjq-gjh9
Remediation
- Fix · GHSA-jmh9-6rjq-gjh9 pimcore/admin-ui-classic-bundle (Packagist) Fixed in 1.4.3 Advisory →
Timeline
- 2026-10-03 Threatist record created from GHSA-jmh9-6rjq-gjh9
References
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences