adam/znc
1
0 Fork 0
mirror of https://github.com/znc/znc.git synced 2026-10-31 01:32:02 +01:00
Code Issues 362 Packages Projects Releases Wiki Activity

update bundled jQuery (CVE-2020-11022, CVE-2020-11023) #1101

New Issue
Closed
opened 2026-10-05 05:03:14 +02:00 by adam · 0 comments
adam commented 2026-10-05 05:03:14 +02:00
Owner
Copy link
Copy source

The ZNC web interface ships a bundled copy of jQuery 1.11.2 at:
webskins/default/pub/jquery-1.11.2.js

This version is vulnerable to XSS via DOM manipulation methods
(CVE-2020-11022, CVE-2020-11023, fixed in jQuery 3.5.0). Since ZNC
actively serves this file to users via its web interface, the XSS
vulnerability is exploitable via the ZNC web UI.
Please update the bundled jQuery to 3.5.0 or later.

The ZNC web interface ships a bundled copy of jQuery 1.11.2 at: webskins/_default_/pub/jquery-1.11.2.js This version is vulnerable to XSS via DOM manipulation methods (CVE-2020-11022, CVE-2020-11023, fixed in jQuery 3.5.0). Since ZNC actively serves this file to users via its web interface, the XSS vulnerability is exploitable via the ZNC web UI. Please update the bundled jQuery to 3.5.0 or later. <!-- github-sync-id:5265179537 -->
adam closed this issue 2026-10-05 05:03:14 +02:00
Sign in to join this conversation.
No Branch/Tag Specified
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
adam (Adam Wojcieszonek)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: adam/znc#1101