JQuery CVE-2015-9251 Cross Site Scripting Vulnerability

Bugtraq ID:	105658
Class:	Input Validation Error
CVE:	CVE-2015-9251
Remote:	Yes
Local:	No
Published:	Jan 18 2018 12:00AM
Updated:	Jul 17 2019 07:00AM
Credit:	Oleg Gaidarenko
Vulnerable:	Oracle Weblogic Server 12.2.1.3 Oracle Weblogic Server 12.1.3.0 Oracle WebCenter Sites 11.1.1 8.0 Oracle Utilities Mobile Workforce Management 2.3 Oracle Utilities Framework 4.3.0.4 Oracle Utilities Framework 4.3.0.3.0 Oracle Utilities Framework 4.3.0.2.0 Oracle Utilities Framework 4.3.0.1.0 Oracle Utilities Framework 4.3.0.1 Oracle Service Bus 12.2.1.3.0 Oracle Service Bus 12.1.3.0.0 Oracle Retail Workforce Management Software 1.64 Oracle Retail Workforce Management Software 1.60.9 Oracle Retail Sales Audit 15.0 Oracle Retail Invoice Matching 15.0 Oracle Retail Customer Insights 16.0 Oracle Retail Customer Insights 15.0 Oracle Retail Allocation 15.0.2 Oracle Real-Time Scheduler 2.3.0.0 Oracle Primavera Unifier 18.8 Oracle Primavera Unifier 17.7 Oracle Primavera Unifier 17.12 Oracle Primavera Unifier 16.2 Oracle Primavera Unifier 16.1 Oracle Primavera Gateway 17.12 Oracle Primavera Gateway 16.2 Oracle Primavera Gateway 15.2 Oracle PeopleSoft Enterprise PeopleTools 8.57 Oracle PeopleSoft Enterprise PeopleTools 8.56 Oracle PeopleSoft Enterprise PeopleTools 8.55 Oracle OSS Support Tools 19.1 Oracle JDeveloper 12.2.1.3.0 Oracle JDeveloper 12.1.3.0.0 Oracle JDeveloper 11.1.1.9.0 Oracle JD Edwards EnterpriseOne Tools 9.2 Oracle Insurance Insbridge Rating and Underwriting 5.5 Oracle Insurance Insbridge Rating and Underwriting 5.4 Oracle Insurance Insbridge Rating and Underwriting 5.2 Oracle Hospitality Reporting and Analytics 9.1 Oracle Hospitality Materials Control 18.1 Oracle Hospitality Guest Access 4.2.1 Oracle Hospitality Guest Access 4.2 Oracle Healthcare Translational Research 3.1 Oracle Healthcare Foundation 7.2 Oracle Healthcare Foundation 7.1 Oracle Fusion Middleware MapViewer 12.2.1.3.0 Oracle Financial Services Reconciliation Framework 8.0.6 Oracle Financial Services Reconciliation Framework 8.0.5 Oracle Financial Services Profitability Management 8.0.6 Oracle Financial Services Profitability Management 8.0.5 Oracle Financial Services Profitability Management 8.0.4 Oracle Financial Services Market Risk Measurement and Management 8.0.6 Oracle Financial Services Market Risk Measurement and Management 8.0.5 Oracle Financial Services Loan Loss Forecasting and Provisioning 8.0.7 Oracle Financial Services Loan Loss Forecasting and Provisioning 8.0.5 Oracle Financial Services Loan Loss Forecasting and Provisioning 8.0.4 Oracle Financial Services Loan Loss Forecasting and Provisioning 8.0.3 Oracle Financial Services Loan Loss Forecasting and Provisioning 8.0.2 Oracle Financial Services Liquidity Risk Management 8.0.6 Oracle Financial Services Liquidity Risk Management 8.0.4 Oracle Financial Services Liquidity Risk Management 8.0.2 Oracle Financial Services Hedge Management and IFRS Valuations 8.0.7 Oracle Financial Services Hedge Management and IFRS Valuations 8.0.5 Oracle Financial Services Hedge Management and IFRS Valuations 8.0.4 Oracle Financial Services Funds Transfer Pricing 8.0.7 Oracle Financial Services Funds Transfer Pricing 8.0.5 Oracle Financial Services Funds Transfer Pricing 8.0.4 Oracle Financial Services Data Integration Hub 8.0.7 Oracle Financial Services Data Integration Hub 8.0.5 Oracle Financial Services Asset Liability Management 8.0.7 Oracle Financial Services Asset Liability Management 8.0.5 Oracle Financial Services Asset Liability Management 8.0.4 Oracle Financial Services Analytical Applications Infrastructure 8.0.7 Oracle Financial Services Analytical Applications Infrastructure 8.0.6 Oracle Financial Services Analytical Applications Infrastructure 8.0.5 Oracle Financial Services Analytical Applications Infrastructure 8.0.4 Oracle Financial Services Analytical Applications Infrastructure 8.0.3 Oracle Financial Services Analytical Applications Infrastructure 8.0.2 Oracle Financial Services Analytical Applications Infrastructure 8.0.1 Oracle Financial Services Analytical Applications Infrastructure 8.0 Oracle Financial Services Analytical Applications Infrastructure 7.3.5 Oracle Financial Services Analytical Applications Infrastructure 7.3.4 Oracle Financial Services Analytical Applications Infrastructure 7.3.3 Oracle Enterprise Operations Monitor 4.0 Oracle Enterprise Operations Monitor 3.4 Oracle Enterprise Manager Ops Center 12.3.3 Oracle Enterprise Manager Ops Center 12.2.2 Oracle Endeca Information Discovery Studio 3.2 Oracle Endeca Information Discovery Studio 3.1 Oracle Diagnostic Assistant 2.12 Oracle Communications WebRTC Session Controller 7.1 Oracle Communications WebRTC Session Controller 7.0 Oracle Communications Interactive Session Recorder 6.2 Oracle Communications Interactive Session Recorder 6.1 Oracle Communications Interactive Session Recorder 6.0 Oracle Communications Converged Application Server 7.0 Oracle Communications Application Session Controller 3.8 Oracle Communications Application Session Controller 3.7.1 Oracle Business Process Management Suite 12.2.1.3.0 Oracle Business Process Management Suite 12.1.3.0.0 Oracle Business Process Management Suite 11.1.1.9.0 Oracle Business Intelligence Enterprise Edition 12.2.1.4.0 Oracle Business Intelligence Enterprise Edition 11.1.1.9.0 Oracle Banking Platform 2.6.2 Oracle Banking Platform 2.6.1 Oracle Banking Platform 2.6 Oracle Agile Product Lifecycle Management for Process 6.2.3.1 Oracle Agile Product Lifecycle Management for Process 6.2.3.0 Oracle Agile Product Lifecycle Management for Process 6.2.2.0 Oracle Agile Product Lifecycle Management for Process 6.2.1.0 Oracle Agile Product Lifecycle Management for Process 6.2.0.0 jQuery jQuery 1.9 jQuery jQuery 1.6.3 jQuery jQuery 1.6.2 jQuery jQuery 1.6.1 jQuery jQuery 1.4.2 jQuery jQuery 1.2.6 jQuery jQuery 2.2 jQuery jQuery 2.1 jQuery jQuery 1.8.1 jQuery jQuery 1.8.0 jQuery jQuery 1.7.2 jQuery jQuery 1.7.1 jQuery jQuery 1.6.4 jQuery jQuery 1.6 Aveva InTouch Access Anywhere 2017 Update 2 Aveva InTouch Access Anywhere 2017
Not Vulnerable:	Oracle Diagnostic Assistant 2.12.36 Oracle Communications WebRTC Session Controller 7.2 Oracle Communications Converged Application Server 7.0.0.1 jQuery jQuery 3.0 Aveva InTouch Access Anywhere 2017 Update 2b

JQuery CVE-2015-9251 Cross Site Scripting Vulnerability

JQuery is prone to a cross-site-scripting vulnerability because it fails to sufficiently sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Versions prior to JQuery 3.0.0 are vulnerable.

JQuery CVE-2015-9251 Cross Site Scripting Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

JQuery CVE-2015-9251 Cross Site Scripting Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

JQuery CVE-2015-9251 Cross Site Scripting Vulnerability

References:

• Ajax: Mitigate possible XSS vulnerability (Jquery)
  
• Ajax: Mitigate possible XSS vulnerability #2588 (Jquery)
  
• JQuery Home Page (JQuery )
  
• AVEVA Security Bulletin LFSEC00000126 (Aveva)
  
• ICSA-18-212-04 AVEVA InTouch Access Anywhere (CERT)
  
• Oracle Critical Patch Update Advisory - April 2019 (Oracle)
  
• Oracle Critical Patch Update Advisory - January 2019 (Oracle)
  
• Oracle Critical Patch Update Advisory - July 2019 (Oracle)
  
• Oracle Critical Patch Update Advisory - October 2018 (Oracle)