LarryD.25867 (Customer) asked a question.
Vulnerability on JQuery Okta Sign-In Widget
We observed a vulnerable JavaScript library.
JQuery version 1.12.4, which has the following vulnerabilities:
• CVE-2015-9251: 3rd party CORS request may execute
• CVE-2015-9251: parseHTML() executes scripts in event handlers
• CVE-2019-11358: jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution
• CVE-2020-11022: Regex in its jQuery.htmlPrefilter sometimes may introduce XSS
• CVE-2020-11023: Regex in its jQuery.htmlPrefilter sometimes may introduce XSS
Hi @LarryD.25867 (Customer),
Thank you for posting on the Okta community page!
I have done some research and I have managed to find the bellow documentation that contains information about the 1.12.4 JQuery version:
I hope the above information is useful!