GHSA-jmh9-6rjq-gjh9
Vulnerable embedded jQuery Version
GHSA-jmh9-6rjq-gjh9 is a vulnerability with no CVSS score yet in pimcore/admin-ui-classic-bundle, published June 5, 2024. No source lists public exploit code. Fixed in pimcore/admin-ui-classic-bundle 1.4.3.
- Severity
- UnratedNo CVSS score yet
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
1.4.3pimcore/admin-ui-classic-bundle +1 more
Description
Summary
PIMCore uses the JavaScript library jQuery in version 3.4.1. This version is vulnerable to cross-site-scripting (XSS).
Details
In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing elements from untrusted sources - even after sanitizing it to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.
Publish Date: 2020-04-29
Affected packages
| Package | Affected | Fixed |
|---|---|---|
pimcore/admin-ui-classic-bundlePackagist | through 1.4.2 | 1.4.3 |
pimcore/admin-ui-classic-bundlePackagist | before 1.4.3, plus listed versions 1.4.0v1.0.0v1.0.0-BETA1v1.0.0-RC1v1.0.0-RC2 Show 26 moreShow lessv1.0.1v1.0.2v1.0.3v1.0.4v1.0.5v1.0.6v1.1.0v1.1.0-RC1v1.1.1v1.1.2v1.1.3v1.1.4v1.2v1.2.0-RC1v1.2.1v1.2.2v1.2.3v1.3.0v1.3.0-RC1v1.3.1v1.3.2v1.3.3v1.3.4v1.3.5v1.4.1v1.4.2 | 1.4.3 |
What each source reports
GitHub AdvisoriesNo score
Vulnerable embedded jQuery Version
Summary
PIMCore uses the JavaScript library jQuery in version 3.4.1. This version is vulnerable to cross-site-scripting (XSS).
Details
In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing elements from untrusted sources - even after sanitizing it to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.
Publish Date: 2020-04-29
- Record
GHSA-jmh9-6rjq-gjh9- Updated
- 2026-11-02
OSVNo score
Vulnerable embedded jQuery Version
Summary
PIMCore uses the JavaScript library jQuery in version 3.4.1. This version is vulnerable to cross-site-scripting (XSS).
Details
In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing elements from untrusted sources - even after sanitizing it to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.
Publish Date: 2020-04-29
- Record
GHSA-jmh9-6rjq-gjh9- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.