CVE-2011-4969 jQuery vulnerable to Cross-Site Scripting (XSS)

Medium 4.3 Published 8 Mar 2013 Updated 7 Aug 2024

Remote attackers can inject arbitrary web script or HTML via crafted tags when using location.hash, affecting applications using vulnerable jQuery versions.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2011-4969?

CVE-2011-4969 is a medium-severity cross-site scripting vulnerability in n/a, published on 8 Mar 2013. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Cross-site scripting (XSS) vulnerability in jQuery before 1.6.3, when using location.hash to select elements, allows remote attackers to inject arbitrary web script or HTML via a crafted tag.

Weakness: CWE-79

Which versions are affected by CVE-2011-4969?

8 open source packages ship an affected version, including org.webjars.npm:jquery, jQuery and jquery-rails. It affects 1 product.

Package	Affected	Fixed in
`org.webjars.npm:jquery` Maven	All versions	`1.6.3`
`org.webjars.npm:jquery` Maven	All versions	`1.6.3`
`jQuery` NuGet	All versions	`1.6.3`
`jQuery` NuGet	All versions	`1.6.3`
`jquery-rails` RubyGems	All versions	`1.0.16`
`jquery-rails` RubyGems	All versions	`1.0.16`

2 more packages

`jquery` npm	All versions	`1.6.3`
`jquery` npm	All versions	`1.6.3`

Products include Jquery Jquery.

How do I fix CVE-2011-4969?

Upgrade org.webjars.npm:jquery to 1.6.3 or later.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2011-4969 being exploited?

There is no known exploitation of CVE-2011-4969 in the wild and no public exploit code.

Sources

Also known as AZL-44421, CVE-2013-5989, GHSA-579v-mp3v-rrw5.