CVE-2015-9251 Cross-Site Scripting (XSS) in jquery

What is CVE-2015-9251?

CVE-2015-9251 is a medium-severity vulnerability in Oracle Banking Platform, published on 18 Jan 2018.

Official description

jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed.

Weakness: CWE-79

Which versions are affected by CVE-2015-9251?

14 open source packages ship an affected version, including org.webjars.npm:jquery, jQuery and jquery-rails. It affects 47 products.

Products include Jquery Jquery, Oracle Agile Product Lifecycle Management for Process, Oracle Banking Platform, Oracle Business Process Management Suite, Oracle Communications Converged Application Server, Oracle Communications Interactive Session Recorder and 41 more.

How do I fix CVE-2015-9251?

Upgrade org.webjars.npm:jquery to a fixed version for your release line: 1.12.2 or 3.0.0.

Is CVE-2015-9251 being exploited?

There is no known exploitation of CVE-2015-9251 in the wild and no public exploit code.

Public exploit code: 4 proofs of concept on GitHub.

Other vulnerabilities in Oracle Banking Platform

• CVE-2016-10707 Denial of Service in jquery High 7.5
• CVE-2020-7656 Cross-Site Scripting in jquery Medium 6.1
• CVE-2018-18405 Cross-site scripting in n/a Medium 6.1
• CVE-2012-6708 Cross-Site Scripting in jquery Medium 6.1
• CVE-2014-6071 Cross-site scripting in n/a Medium 6.1

All Oracle Banking Platform vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as ALPINE-CVE-2015-9251, AZL-109766, AZL-41228, AZL-45099, CLEANSTART-2026-FZ67762, CVE-2017-16012 and 2 more.