Uploaded image for project: 'Bamboo Data Center'
  1. Bamboo Data Center
  2. BAM-19990

The versions of jQuery and jQuery UI in use are vulnerable to several issues

XMLWordPrintable

      Similar to JRASERVER-43422, the version of jQuery used (currently version 1.10.2) is vulnerable to jQuery issue 2432 (3rd party $.get() auto executes if content type is text/javascript) and 11974 (parseHTML executes inline scripts like event handlers). Additionally, the version of jQuery UI in use (1.8.24) is vulnerable to CVE-2010-5312 and an attacker can exploit this issue if they are able to provide values to "title" of a jQuery ui dialogue. Actual exploitation / impact to Bamboo depends upon if & how the vulnerable code paths are used.

      On a related note, http://research.insecurelabs.org/jquery/test/ can be used to check jQuery versions for issues.

            [BAM-19990] The versions of jQuery and jQuery UI in use are vulnerable to several issues

            No work has yet been logged on this issue.

              vdebone Victor Debone
              dblack David Black
              Affected customers:
              0 This affects my team
              Watchers:
              8 Start watching this issue

                Created:
                Updated:
                Resolved: