DRUPAL-CONTRIB-2022-004 jQuery UI is a third-party library used by Drupal.
Cross-site scripting vulnerabilities in jQuery UI Datepicker allow attackers to execute arbitrary scripts in user browsers via crafted input.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is DRUPAL-CONTRIB-2022-004?
DRUPAL-CONTRIB-2022-004 is a cross-site scripting vulnerability in drupal/jquery_ui_datepicker, published on 19 Jan 2022. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
jQuery UI is a third-party library used by Drupal. The jQuery UI Datepicker module provides the jQuery UI Datepicker library, which is not included in Drupal 9 core.
jQuery UI was previously thought to be end-of-life.
Late in 2021, jQuery UI announced that they would be continuing development, and released a jQuery UI 1.13.0 version. As part of this 1.13.0 update, they disclosed the following security issues that may affect site using the jQuery UI Datepicker module:
- CVE-2021-41182: XSS in the altField option of the Datepicker widget
- CVE-2021-41183: XSS in *Text options of the Datepicker widget
Which versions are affected by DRUPAL-CONTRIB-2022-004?
Linux distribution packages (1)
drupal/jquery_ui_datepicker Packagist:https://packages.drupal.org/8 | All versions | 1.2.0 |
How do I fix DRUPAL-CONTRIB-2022-004?
Upgrade to a fixed version.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is DRUPAL-CONTRIB-2022-004 being exploited?
There is no known exploitation of DRUPAL-CONTRIB-2022-004 in the wild and no public exploit code.