CVE-2021-41182

Published: Oct 26, 2021Modified: Jun 17, 2026

6.1

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.8 / Impact: 2.7

Source: NVD

Description

jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the `altField` option of the Datepicker widget from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. Any string value passed to the `altField` option is now treated as a CSS selector. A workaround is to not accept the value of the `altField` option from untrusted sources.

Affected (51)

Products: Jqueryui: Jquery Ui · Fedoraproject: Fedora · Netapp: H500s Firmware, H700s Firmware, H300e Firmware, H500e Firmware, H700e Firmware, H410s Firmware, H410c Firmware, H300s Firmware · +4 more

Show all products

1 product

1 product

8 products

1 product

1 product

16 products

Mysql Enterprise Monitor

Big Data Spatial And Graph

Communications Interactive Session Recorder

Communications Operations Monitor

Hospitality Inventory Management

Hospitality Materials Control

Hospitality Suite8

Jd Edwards Enterpriseone Tools

Peoplesoft Enterprise Peopletools

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Jqueryui Jquery Ui	Before 1.13.0

Configuration B

4 vulnerable

Vulnerable Software	Affected Versions
Fedoraproject Fedora	Version 33
Fedoraproject Fedora	Version 34
Fedoraproject Fedora	Version 35
Fedoraproject Fedora	Version 36

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp H500s Firmware	All versions

Running on/with	Platform Versions
Netapp H500s	All versions

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp H700s Firmware	All versions

Running on/with	Platform Versions
Netapp H700s	All versions

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp H300e Firmware	All versions

Running on/with	Platform Versions
Netapp H300e	All versions

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp H500e Firmware	All versions

Running on/with	Platform Versions
Netapp H500e	All versions

Configuration G

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp H700e Firmware	All versions

Running on/with	Platform Versions
Netapp H700e	All versions

Configuration H

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp H410s Firmware	All versions

Running on/with	Platform Versions
Netapp H410s	All versions

Configuration I

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp H410c Firmware	All versions

Running on/with	Platform Versions
Netapp H410c	All versions

Configuration J

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp H300s Firmware	All versions

Running on/with	Platform Versions
Netapp H300s	All versions

Configuration K

1 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 9.0

Configuration L

1 vulnerable

Vulnerable Software	Affected Versions
Drupal Drupal	From 7.0 to 7.86

Configuration M

7 vulnerable

Vulnerable Software	Affected Versions
Oracle Mysql Enterprise Monitor	Up to 8.0.29
Oracle Primavera Unifier	Version 17.10
Oracle Primavera Unifier	Version 17.11
Oracle Primavera Unifier	Version 17.12
Oracle Primavera Unifier	Version 17.7
Oracle Primavera Unifier	Version 17.8
Oracle Primavera Unifier	Version 17.9

Configuration N

1 vulnerable

Vulnerable Software	Affected Versions
Tenable Tenable.sc	Before 5.21.0

Configuration O

28 vulnerable

Vulnerable Software	Affected Versions
Oracle Agile Plm	Version 9.3.6
Oracle Application Express	Before 22.1.1
Oracle Banking Platform	Version 2.12.0
Oracle Banking Platform	Version 2.9.0
Oracle Big Data Spatial And Graph	Before 23.1
Oracle Big Data Spatial And Graph	Version 23.1
Oracle Communications Interactive Session Recorder	Version 6.4
Oracle Communications Operations Monitor	Version 4.3
Oracle Communications Operations Monitor	Version 4.4
Oracle Communications Operations Monitor	Version 5.0
Oracle Hospitality Inventory Management	Version 9.1.0
Oracle Hospitality Materials Control	Version 18.1
Oracle Hospitality Suite8	From 8.11.0 to 8.14.0
Oracle Hospitality Suite8	Version 8.10.2
Oracle Jd Edwards Enterpriseone Tools	Up to 9.2.6.3
Oracle Peoplesoft Enterprise Peopletools	Version 8.58
Oracle Peoplesoft Enterprise Peopletools	Version 8.59
Oracle Policy Automation	From 12.2.0 to 12.2.25
Oracle Primavera Unifier	From 17.7 to 17.12
Oracle Primavera Unifier	Version 18.8
Oracle Primavera Unifier	Version 19.12
Oracle Primavera Unifier	Version 20.12
Oracle Primavera Unifier	Version 21.12
Oracle Rest Data Services	Before 22.1.1
Oracle Rest Data Services	Version 22.1.1
Oracle Weblogic Server	Version 12.2.1.3.0
Oracle Weblogic Server	Version 12.2.1.4.0
Oracle Weblogic Server	Version 14.1.1.0.0

Related CWEs

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (32)

https://blog.jqueryui.com/2021/10/jquery-ui-1-13-0-released/

Source: security-advisories@github.com

Release NotesVendor Advisory

https://github.com/jquery/jquery-ui/pull/1954/commits/6809ce843e5ac4128108ea4c15cbc100653c2b63

Source: security-advisories@github.com

PatchThird Party Advisory

https://github.com/jquery/jquery-ui/security/advisories/GHSA-9gj3-hwp5-pmwc

Source: security-advisories@github.com

ExploitMitigationThird Party Advisory

https://lists.debian.org/debian-lts-announce/2022/01/msg00014.html

Source: security-advisories@github.com

Mailing ListThird Party Advisory

https://lists.debian.org/debian-lts-announce/2023/08/msg00040.html

Source: security-advisories@github.com

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HVKIOWSXL2RF2ULNAP7PHESYCFSZIJE3/

Source: security-advisories@github.com

Mailing ListThird Party Advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NXIUUBRVLA4E7G7MMIKCEN75YN7UFERW/

Source: security-advisories@github.com

Mailing ListThird Party Advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/O74SXYY7RGXREQDQUDQD4BPJ4QQTD2XQ/

Source: security-advisories@github.com

Mailing ListThird Party Advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SGSY236PYSFYIEBRGDERLA7OSY6D7XL4/

Source: security-advisories@github.com

Mailing ListThird Party Advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SNXA7XRKGINWSUIPIZ6ZBCTV6N3KSHES/

Source: security-advisories@github.com

Mailing ListThird Party Advisory

https://security.netapp.com/advisory/ntap-20211118-0004/

Source: security-advisories@github.com

Third Party Advisory

https://www.drupal.org/sa-contrib-2022-004

Source: security-advisories@github.com

Third Party Advisory

https://www.drupal.org/sa-core-2022-002

Source: security-advisories@github.com

Third Party Advisory

https://www.oracle.com/security-alerts/cpuapr2022.html

Source: security-advisories@github.com

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpujul2022.html

Source: security-advisories@github.com

PatchThird Party Advisory

https://www.tenable.com/security/tns-2022-09

Source: security-advisories@github.com

Third Party Advisory

https://blog.jqueryui.com/2021/10/jquery-ui-1-13-0-released/