MX80 reporting jquery XSS vulnerability on internal vulnerability scans

CameronGoS
Conversationalist

MX80 reporting jquery XSS vulnerability on internal vulnerability scans

Our MX80 is reporting a jquery XSS vulnerability on its web interface from our internal vulnerability scans.  This URL displays the jquery info which reports v1.10.1: http://192.168.8.1/third_party/jquery/jquery-1.10.1.min.js

 

We are currently running firmware v14.40 and I've scheduled an upgrade to v14.42 but am not expecting that to address this issue.

 

Below is the info from the vulnerability:

Synopsis
The remote web server is affected by multiple cross site scripting vulnerability.

 

Description
According to the self-reported version in the script, the version of JQuery hosted on the remote web server is greater than or equal to 1.2 and prior to 3.5.0. It is, therefore, affected by multiple cross site scripting vulnerabilities.

 

See Also
https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/

 

Solution
Upgrade to JQuery version 3.5.0 or later.

2 REPLIES 2
PhilipDAth
Kind of a big deal

Are you NATing that port to some server or device?

No, it isn't showing up publicly, just locally from internal vulnerability scans.

Get notified when there are additional replies to this discussion.
Welcome to the Meraki Community!
To start contributing, simply sign in with your Cisco account. If you don't yet have a Cisco account, you can sign up.
Labels