0

Vulnerability description

This page is using an older version of jQuery that is vulnerable to a Cross Site Scripting vulnerability. Many sites are using to select elements using location.hash that allows someone to inject script into the page. This problem was fixed in jQuery 1.6.3. This vulnerability affects /js/jquery.js. Discovered by: Scripting (jQuery_Audit.script). Attack details

Pattern found: 
/*!
 * jQuery JavaScript Library v1.3.2
 * http://jquery.com

What was this means?

My website is currently using jQuery JavaScript Library v1.3.2

Is this will get trouble?

2
  • 1.3.2! I think this is a new record!
    – 000
    Commented Sep 9, 2014 at 19:03
  • @JoeFrambach yea, my website also having new record on alexa which rank 4-6 in my country. :) Commented Sep 9, 2014 at 19:23

3 Answers 3

2

Ideally, you should keep your jQuery up to date. However, there are some breaking changes between jQuery versions. 1.7.x started deprecating some event delegations. 2.x started removing support for older browsers.

For your case, I suggest updating your jQuery library to 1.6.3 as recommended. Then thoroughly test your site to make sure everything still works.

If 1.6.3 still works, then I suggest updating to 1.7.2. Then thoroughly test your site to make sure everything still works.

If 1.7.2 still works, then decide if you want to continue supporting older browsers like IE8. If yes, then try updating to 1.11.1. If no, then try updating to 2.1.1. These are the latest versions.

This may not be an easy thing to do. If you stop at 1.6.3, that is understandable and is fine.

2
  • Joe Frambach, Thanks for the beautiful explanation. Commented Sep 9, 2014 at 19:25
  • Check code.jquery.com/jquery for the latest version of 1.x (currently it is 1.12.4).
    – Luke
    Commented Nov 14, 2016 at 16:51
2

Cross site scripting is not JQuery or JavaScript only vulnerability. I highly recommend you read following two article about the subject

0

You may have scanned your site using some tool. These tools work on productions. And as you know that all the jQuery versions before 1.6.3 are vulnerable to Cross Site Scripting using location.hash parameter, that's why it is giving you a security vulnerability.

It is recommended that you update your jQuery version to the latest. And keep in mind that the dependencies, jQuery version 2.x doesn't supports IE, and other older versions of browsers.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.