WaratekVRT Sign in

CVE-2021-41182 jQuery UI

Affected softwarejQuery UI
Severity6.5 Medium CVSS 3.1 3 scores
WeaknessCross-site scripting (CWE-79)
Published26 Oct 2021
Updated25 Aug 2026

Description

jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the altField option of the Datepicker widget from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. Any string value passed to the altField option is now treated as a CSS selector. A workaround is to not accept the value of the altField option from untrusted sources.

Exploitation status

No public exploit

No exploit has been reported in the sources we check. The 1 repository below are public GitHub repositories with fewer than 5 stars.
  • CISA KEV not listed
  • VulnCheck KEV not listed
  • CISA Vulnrichment no assessment published
  • Indexed PoC 1 indexed, none at 5+ stars
  • EPSS 39% chance in 30 days A model's forecast, not a report of exploitation. Higher than 99% of all scored CVEs.

1 of these are GitHub repositories with fewer than 5 stars. They are listed for reference and don't count toward the exploitation status above.

IndexArtifactStarsFirst seen
GitHub PoC Some test files to make a good nuclei template for a JQuery UI XSS vuln 1 2024-08-05

Waratek protection

Outside Waratek scope

A Java vulnerability, but not one Waratek protects. It affects only Java on a user's desktop (applets, Web Start, JavaFX, the installer), sits in a product the Waratek agent can't be installed into, or is in a package we don't expect in business applications. The decision below says which.

  • Protection none
  • Action not pursued none
  • Review human Researcher
  • Record active
Decided by Manual classification of this CVE in the legacy dataset
Finding A manual classification set this CVE's status to Outside Waratek scope, but the CVE names a tracked product.

CVSS

6.5 MEDIUM v3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N 3 metrics

We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.

VersionScoreBandVectorAssignerType
CVSS 3.1 6.5 MEDIUM CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N security-advisories@github.com Secondary published
CVSS 3.1 6.1 MEDIUM CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N NVD Primary
CVSS 2.0 4.3 none AV:N/AC:M/Au:N/C:N/I:P/A:N NVD Primary

Affected software and releases

Oracle advisories

AdvisoryTypeQuarterProducts Oracle names in its risk matrix
Oracle Critical Patch Update October 2024 ↗ CPU 2024-Q4 Oracle Financial Services Applications / Installation (jQueryUI) (3.0.0.0.0, 4.0.0.0.0, 5.0.0.0.0)
Oracle Food and Beverage Applications / Engagement (jQueryUI) (19.1.0-19.6.2)
Oracle Utilities Applications / General (jQueryUI) (4.0.0.0.0, 4.0.0.2.0, 4.0.0.3.0, 4.3.0.3.0-4.3.0.6.0, 4.5.0.0.0)
Oracle Critical Patch Update July 2024 ↗ CPU 2024-Q3 Oracle Communications / Security (jQueryUI) (46.6.4, 46.6.5)
Oracle Critical Patch Update January 2024 ↗ CPU 2024-Q1 Oracle Retail Applications / Internal Operations (jQuery) (18.0.0.14, 19.0.0.8)
Oracle Critical Patch Update October 2023 ↗ CPU 2023-Q4 Oracle Analytics / Mobile Service (jQueryUI) (12.2.1.4.0)
Oracle Critical Patch Update July 2023 ↗ CPU 2023-Q3 Oracle Analytics / Service Administration UI, BI Platform Security (jQueryUI) (6.4.0.0.0)
Oracle Commerce / Experience Manager (jQueryUI) (11.3.2)
Oracle Enterprise Manager / DB Machine Management (jQueryUI) (13.5.0.0)
Oracle Enterprise Manager / Security Management (jQueryUI) (13.5.0.0)
Oracle Critical Patch Update April 2023 ↗ CPU 2023-Q2 Oracle Communications Applications / Vision (jQueryUI) (5.5.0-5.5.10, 6.0.0-6.0.2)
Oracle Financial Services Applications / Infrastructure (jQueryUI) (8.0.7.0, 8.0.8.0, 8.0.9.0, 8.1.0.0, 8.1.1.0, 8.1.2.0, 8.1.2.1, 8.1.2.2)
Oracle Health Sciences Applications / Core (jQueryUI) (Prior to 6.3.1.3, Prior to 7.0.0.1)
Oracle Utilities Applications / User Interface (jQueryUI) (2.3.0.2, 2.4.0.1, 2.5.0.0, 2.5.0.1)
Oracle Critical Patch Update October 2022 ↗ CPU 2022-Q4 Oracle Siebel CRM / Open UI (jQueryUI) (22.8 and prior)
Oracle Critical Patch Update July 2022 ↗ CPU 2022-Q3 Oracle PeopleSoft / XML Publisher (jQueryUI) (8.58, 8.59)

Oracle components and versions

FamilyComponentVersions, as Oracle lists themRead as
Oracle Analytics Mobile Service (jQueryUI) 12.2.1.4.0 12.2.1.4.0
Oracle Analytics Service Administration UI, BI Platform Security (jQueryUI) 6.4.0.0.0 6.4.0.0.0
Oracle Commerce Experience Manager (jQueryUI) 11.3.2 11.3.2
Oracle Communications Security (jQueryUI) 46.6.4, 46.6.5 46.6.4 · 46.6.5
Oracle Communications Applications Vision (jQueryUI) 5.5.0-5.5.10, 6.0.0-6.0.2
Oracle Enterprise Manager DB Machine Management (jQueryUI) 13.5.0.0 13.5.0.0
Oracle Enterprise Manager Security Management (jQueryUI) 13.5.0.0 13.5.0.0
Oracle Financial Services Applications Infrastructure (jQueryUI) 8.0.7.0, 8.0.8.0, 8.0.9.0, 8.1.0.0, 8.1.1.0, 8.1.2.0, 8.1.2.1, 8.1.2.2 8.0.7.0 · 8.0.8.0 · 8.0.9.0 · 8.1.0.0 · 8.1.1.0 · 8.1.2.0 · 8.1.2.1 · 8.1.2.2
Oracle Financial Services Applications Installation (jQueryUI) 3.0.0.0.0, 4.0.0.0.0, 5.0.0.0.0 3.0.0.0.0 · 4.0.0.0.0 · 5.0.0.0.0
Oracle Food and Beverage Applications Engagement (jQueryUI) 19.1.0-19.6.2
Oracle Health Sciences Applications Core (jQueryUI) Prior to 6.3.1.3, Prior to 7.0.0.1
Oracle PeopleSoft XML Publisher (jQueryUI) 8.58, 8.59 8.58 · 8.59
Oracle Retail Applications Internal Operations (jQuery) 18.0.0.14, 19.0.0.8 18.0.0.14 · 19.0.0.8
Oracle Siebel CRM Open UI (jQueryUI) 22.8 and prior
Oracle Utilities Applications General (jQueryUI) 4.0.0.0.0, 4.0.0.2.0, 4.0.0.3.0, 4.3.0.3.0-4.3.0.6.0, 4.5.0.0.0 4.0.0.0.0 · 4.0.0.2.0 · 4.0.0.3.0 · 4.5.0.0.0
Oracle Utilities Applications User Interface (jQueryUI) 2.3.0.2, 2.4.0.1, 2.5.0.0, 2.5.0.1 2.3.0.2 · 2.4.0.1 · 2.5.0.0 · 2.5.0.1

Products and versions

29 products, 51 version entries
SourceVendorProductSchemeAffected versions
nvd debian debian linux generic 9.0
nvd drupal drupal generic ≥ 7.0 and ＜ 7.86
nvd fedoraproject fedora generic 33 · 34 · 35 · 36
nvd jqueryui jquery ui generic ＜ 1.13.0
nvd netapp h300e firmware generic any version
nvd netapp h300s firmware generic any version
nvd netapp h410c firmware generic any version
nvd netapp h410s firmware generic any version
nvd netapp h500e firmware generic any version
nvd netapp h500s firmware generic any version
nvd netapp h700e firmware generic any version
nvd netapp h700s firmware generic any version
nvd oracle agile product lifecycle management generic 9.3.6
nvd oracle application express generic ＜ 22.1.1
nvd oracle banking platform generic 2.9.0 · 2.12.0
nvd oracle big data spatial and graph generic 23.1 · ＜ 23.1
nvd oracle communications interactive session recorder generic 6.4
nvd oracle communications operations monitor generic 4.3 · 4.4 · 5.0
nvd oracle hospitality inventory management generic 9.1.0
nvd oracle hospitality materials control generic 18.1
nvd oracle hospitality suite8 generic 8.10.2 · ≥ 8.11.0 and ≤ 8.14.0
nvd oracle jd edwards enterpriseone tools generic ≤ 9.2.6.3
nvd oracle mysql enterprise monitor generic ≤ 8.0.29
nvd oracle peoplesoft enterprise peopletools generic 8.58 · 8.59
nvd oracle policy automation generic ≥ 12.2.0 and ≤ 12.2.25
nvd oracle primavera unifier generic 17.7 · ≥ 17.7 and ≤ 17.12 · 17.8 · 17.9 · 17.10 · 17.11 · 17.12 · 18.8 · 19.12 · 20.12 · 21.12
nvd oracle rest data services generic 22.1.1 · ＜ 22.1.1
nvd oracle weblogic server generic 12.2.1.3.0 · 12.2.1.4.0 · 14.1.1.0.0
nvd tenable tenable.sc generic ＜ 5.21.0

References

URLTags
https://blog.jqueryui.com/2021/10/jquery-ui-1-13-0-released/ Release Notes, Vendor Advisory
https://github.com/jquery/jquery-ui/pull/1954/commits/6809ce843e5ac4128108ea4c15cbc100653c2b63 Patch, Third Party Advisory
https://github.com/jquery/jquery-ui/security/advisories/GHSA-9gj3-hwp5-pmwc Exploit, Mitigation, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/01/msg00014.html Mailing List, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2023/08/msg00040.html
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HVKIOWSXL2RF2ULNAP7PHESYCFSZIJE3/ Mailing List, Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NXIUUBRVLA4E7G7MMIKCEN75YN7UFERW/ Mailing List, Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/O74SXYY7RGXREQDQUDQD4BPJ4QQTD2XQ/ Mailing List, Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SGSY236PYSFYIEBRGDERLA7OSY6D7XL4/ Mailing List, Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SNXA7XRKGINWSUIPIZ6ZBCTV6N3KSHES/ Mailing List, Third Party Advisory

Timeline
Published2021-10-26By the CVE Program.
NVD record modified2026-08-25NVD's own last-modified date for this record.