TB092 jQuery Version Affected by CVE-2020-11023 (Cross-Site Scripting Vulnerability)

Impact

FIPS 199 Severity Level: High

CVSS Score: 7.6 

Attack Vector (AV): N

Attack Complexity (AC): L

Privileges Required (PR): L

User Interaction (UI): R

Scope (S): C

Confidentiality (C): N

Integrity (I): H

Availability (A): L

The Delphix Virtualization Engine includes a version of the jQuery library that is impacted by a cross-site scripting (XSS) vulnerability (CVE-2020-11023): jQuery may execute untrusted code when passing HTML from untrusted sources. From the jQuery blog about the 3.5.0 release:

jQuery used a regex in its jQuery.htmlPrefilter method to ensure that all closing tags were XHTML-compliant when passed to methods. For example, this prefilter ensured that a call like jQuery("<div class='hot' />") is actually converted to jQuery("<div class='hot'></div>"). Recently, an issue was reported that demonstrated the regex could introduce a cross-site scripting (XSS) vulnerability.

The HTML parser in jQuery <=3.4.1 usually did the right thing, but there were edge cases where parsing would have unintended consequences. 

Contributing Factors

This article applies to the following versions of the Delphix engine:

Major Release	All Sub Releases
6.0	6.0.0.0, 6.0.1.0, 6.0.1.1, 6.0.2.0, 6.0.2.1, 6.0.3.0, 6.0.3.1, 6.0.4.0, 6.0.4.1, 6.0.4.2, 6.0.5.0, 6.0.6.0, 6.0.6.1, 6.0.7.0
5.3	5.3.0.0, 5.3.0.1, 5.3.0.2, 5.3.0.3, 5.3.1.0, 5.3.1.1, 5.3.1.2, 5.3.2.0, 5.3.3.0, 5.3.3.1, 5.3.4.0, 5.3.5.0, 5.3.6.0, 5.3.7.0, 5.3.7.1, 5.3.8.0, 5.3.8.1, 5.3.9.0
5.2	5.2.2.0, 5.2.2.1, 5.2.3.0, 5.2.3.1, 5.2.4.0, 5.2.5.0, 5.2.5.1, 5.2.6.0, 5.2.6.1, 5.2.6.2

The Delphix Masking Engine is not affected by this vulnerability.

Symptoms

The vulnerable function within the jQuery library is used in the following ways within the Delphix Virtualization product:

• Throughout the Delphix Self-Service’s functionality

• On the login page for the Delphix Virtualization Engine

Again, the Delphix Masking Engine is not affected by this vulnerability.

Relief/Workaround

None

Related Documents

None