Miggo Logo
Miggo Vulnerability Database
→
GHSA-v73w-r9xg-7cr9

GHSA-v73w-r9xg-7cr9: Use of insecure jQuery version in OctoberCMS

N/A

CVSS Score

Basic Information

CVE ID
-
GHSA ID
GHSA-v73w-r9xg-7cr9
EPSS Score
-
CWE
-
Published
6/5/2020
Updated
1/9/2023
KEV Status
No
Technology
TechnologyPHP

Technical Details

CVSS Vector
-
Package NameEcosystemVulnerable VersionsFirst Patched Version
october/octobercomposer>= 1.0.319, < 1.0.4661.0.466
october/systemcomposer>= 1.0.319, < 1.0.4661.0.466

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems directly from using jQuery <3.5.0. The advisory explicitly calls out DOM manipulation methods like html() and append() as vulnerable vectors. OctoberCMS's commit 5c7ba9f patches this by updating jQuery files, confirming the vulnerability resides in these bundled JS files. While no OctoberCMS PHP functions are explicitly listed, the frontend JS dependencies (jQuery methods) are the attack surface. The high confidence comes from: 1) Direct reference to jQuery's CVE-2020-11022 in the advisory, 2) Patch clearly updating jQuery files, and 3) Vulnerability mechanism being well-documented in jQuery's own security guidance.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

### Imp**t P*ssin* *TML *rom untrust** sour**s - *v*n **t*r s*nitizin* it - to on* o* jQu*ry's *OM m*nipul*tion m*t*o*s (i.*. .*tml(), .*pp*n*(), *n* ot**rs) m*y *x**ut* untrust** *o**. ### P*t***s Issu* **s ***n p*t**** in *uil* *** (v*.*.***) *y *

Reasoning

T** vuln*r**ility st*ms *ir**tly *rom usin* `jQu*ry` <*.*.*. T** **visory *xpli*itly **lls out *OM m*nipul*tion m*t*o*s lik* `*tml()` *n* `*pp*n*()` *s vuln*r**l* v**tors. O*to**r*MS's *ommit ******* p*t***s t*is *y up**tin* `jQu*ry` *il*s, *on*irmin