CVE-2021-41184

MEDIUM 1 PoC

HIGH Priority: 2.49 BB Relevance: 80/100

Published: 2021-10-26 Modified: 2026-11-02 First seen: 2026-11-02 Status: active

Attack Surface

Network Low Complexity No Auth Scope Change

CVSS Vector Breakdown

AV: Network

AC: Low

PR: None

UI: Required

S: Changed

C: Low

I: Low

A: None

Description

jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the `of` option of the `.position()` util from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. Any string value passed to the `of` option is now treated as a CSS selector. A workaround is to not accept the value of the `of` option from untrusted sources.

Weakness Classification (1)

CWE-79 — CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected Software (44)

Vendor	Product	Version
drupal	drupal	7.0 – 7.86
fedoraproject	fedora	33
fedoraproject	fedora	34
fedoraproject	fedora	35
fedoraproject	fedora	36
jquery	jquery-ui	< 1.13.0
jqueryui	jquery_ui	< 1.13.0
netapp	h300e_firmware	-
netapp	h300s_firmware	-
netapp	h410c_firmware	-
netapp	h410s_firmware	-
netapp	h500e_firmware	-
netapp	h500s_firmware	-
netapp	h700e_firmware	-
netapp	h700s_firmware	-
oracle	agile_product_lifecycle_management	9.3.6
oracle	application_express	< 22.1.1
oracle	banking_platform	2.9.0
oracle	banking_platform	2.12.0
oracle	big_data_spatial_and_graph	< 23.1
oracle	big_data_spatial_and_graph	23.1
oracle	communications_interactive_session_recorder	6.4
oracle	communications_operations_monitor	4.3
oracle	communications_operations_monitor	4.4
oracle	communications_operations_monitor	5.0
oracle	hospitality_inventory_management	9.1.0
oracle	hospitality_materials_control	18.1
oracle	hospitality_suite8	8.11.0 – 8.14.0
oracle	hospitality_suite8	8.10.2
oracle	jd_edwards_enterpriseone_tools	< 9.2.6.3