What’s Vulnerable › Vulnerabilities
CVE-2015-9251
- Severity: medium (CVSS 6.1 v3.0)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 29.7% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2018-01-18 · updated 2026-06-17
- Weakness: CWE-79
Description
jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed.
Affected products
- jQuery: before 3.0.0 — fixed in 3.0.0
- Oracle Corporation Oracle Agile Product Lifecycle Management for Process: 6.2.0.0, 6.2.1.0, 6.2.2.0, 6.2.3.0, 6.2.3.1
- Oracle Banking Platform: 2.6.0, 2.6.1, 2.6.2
- Oracle Corporation Oracle Business Process Management Suite: 11.1.1.9.0, 12.1.3.0.0, 12.2.1.3.0
- Oracle Corporation Oracle Communications Converged Application Server: before 7.0.0.1 — fixed in 7.0.0.1
- Oracle Corporation Communications Interactive Session Recorder: 6.0, 6.1, 6.2
- Oracle Communications Services Gatekeeper: before 6.1.0.4.0 — fixed in 6.1.0.4.0
- Oracle Corporation Communications WebRTC Session Controller: before 7.2 — fixed in 7.2
- Oracle Endeca Information Discovery Studio: 3.1.0, 3.2.0
- Oracle Corporation Enterprise Manager Ops Center: 12.2.2, 12.3.3
- Oracle Enterprise Operations Monitor: 3.4, 4.0
- Oracle Corporation Financial Services Analytical Applications Infrastructure: from 7.3.3 through 7.3.5; from 8.0.0 through 8.0.7
- Oracle Corporation Financial Services Asset Liability Management: from 8.0.4 through 8.0.7
- Oracle Financial Services Data Integration Hub: from 8.0.5 through 8.0.7
- Oracle Corporation Financial Services Funds Transfer Pricing: from 8.0.4 through 8.0.7
- Oracle Corporation Financial Services Hedge Management and IFRS Valuations: from 8.0.4 through 8.0.7
- Oracle Corporation Financial Services Liquidity Risk Management: from 8.0.2 through 8.0.6
- Oracle Corporation Financial Services Loan Loss Forecasting and Provisioning: from 8.0.2 through 8.0.7
- Oracle Corporation Financial Services Market Risk Measurement and Management: 8.0.5, 8.0.6
- Oracle Corporation Financial Services Profitability Management: from 8.0.4 through 8.0.6
- Oracle Financial Services Reconciliation Framework: 8.0.5, 8.0.6
- Oracle Corporation Fusion Middleware MapViewer: 12.2.1.3.0
- Oracle Healthcare Foundation: 7.1, 7.2
- Oracle Healthcare Translational Research: 3.1.0
- Oracle Corporation Hospitality Cruise Fleet Management: 9.0.11
- Oracle Corporation Hospitality Guest Access: 4.2.0, 4.2.1
- Oracle Corporation Hospitality Materials Control: 18.1
- Oracle Corporation Hospitality Reporting and Analytics: 9.1.0
- Oracle Insurance Insbridge Rating And Underwriting: 5.2, 5.4, 5.5
- Oracle Corporation JD Edwards EnterpriseOne Tools: 9.2
How to fix
Upgrade to a fixed version: jQuery 3.0.0; Oracle Corporation Oracle Communications Converged Application Server 7.0.0.1; Oracle Communications Services Gatekeeper 6.1.0.4.0; Oracle Corporation Communications WebRTC Session Controller 7.2. Check the vendor advisory for mitigations.
References
- http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00041.html
- http://packetstormsecurity.com/files/152787/dotCMS-5.1.1-Vulnerable-Dependencies.html
- http://packetstormsecurity.com/files/153237/RetireJS-CORS-Issue-Script-Execution.html
- http://packetstormsecurity.com/files/156743/OctoberCMS-Insecure-Dependencies.html
- http://seclists.org/fulldisclosure/2019/May/10
- http://seclists.org/fulldisclosure/2019/May/11
- http://seclists.org/fulldisclosure/2019/May/13
- http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
- http://www.securityfocus.com/bid/105658
- https://access.redhat.com/errata/RHSA-2020:0481
- https://access.redhat.com/errata/RHSA-2020:0729
- https://github.com/jquery/jquery/commit/f60729f3903d17917dc351f3ac87794de379b0cc
Get alerted when CVE-2015-9251 or the next vulnerability affects your stack