<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body style="overflow-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;">Hi Tobias,<div><br></div><div>I stand corrected. To be very honest, I personally think the XSS issue this version has is not exploitable (easily) and I cannot think of any way running this version would impact the security of the BlueOnyx UI.</div><div><br></div><div>I agree we should always aim to run on non-vulnerable versions, but as sometimes upgrading to newer versions break the compatibility this would not be an easy effort.</div><div><br></div><div>But maybe Michael has a different view.</div><div><br></div><div>Best regards,</div><div><br></div><div>Taco</div><div><br><div><div><br><blockquote type="cite"><div>On 12 Dec 2023, at 16:10, Tobias Gablunsky <t.gablunsky@cbxnet.de> wrote:</div><br class="Apple-interchange-newline"><div><meta charset="UTF-8"><div style="caret-color: rgb(0, 0, 0); font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; font-family: arial, helvetica, sans-serif; font-size: 11pt; padding: 0px; margin: 0px;">Hi Taco,</div><div style="caret-color: rgb(0, 0, 0); font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; font-family: arial, helvetica, sans-serif; font-size: 11pt; padding: 0px; margin: 0px;"><span style="font-size: 11pt; font-family: arial, helvetica, sans-serif;"><br></span></div><div style="caret-color: rgb(0, 0, 0); font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; font-family: arial, helvetica, sans-serif; font-size: 11pt; padding: 0px; margin: 0px;"><span style="font-size: 11pt; font-family: arial, helvetica, sans-serif;">if you do a </span><span style="font-size: 11pt; font-family: arial, helvetica, sans-serif;">"grep -o "<a href="jquery:........">jquery:........</a>" /usr/sausalito/ui/web/.adm/scripts/plugins-min.js" you get as output "jquery:"1.7.2",". This is on a 5209R as well as on a 5211R.</span></div><div style="caret-color: rgb(0, 0, 0); font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; font-family: arial, helvetica, sans-serif; font-size: 11pt; padding: 0px; margin: 0px;"><span style="font-size: 11pt; font-family: arial, helvetica, sans-serif;"><br></span></div><div style="caret-color: rgb(0, 0, 0); font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; font-family: arial, helvetica, sans-serif; font-size: 11pt; padding: 0px; margin: 0px;"><span style="font-family: inherit; font-size: inherit;"><br></span></div><div style="caret-color: rgb(0, 0, 0); font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; font-family: arial, helvetica, sans-serif; font-size: 11pt; padding: 0px; margin: 0px;"><span style="font-family: inherit; font-size: inherit;">Viele Grüße,</span><br></div><div class="signatureContainer" style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><div class="signature"><p>i.A. Tobias Gablunsky<br>IT-Infrastruktur & Lösungen<br>____________________________________________<br>CBXNET combox internet GmbH<br>Landhausstr. 22 | 10717 Berlin<br>Tel: +49 (30) 5900 69-00<br>Fax: +49 (30) 5900 69-99<br><a href="https://webmail.cbxnet.combox.group/www.cbxnet.de" target="_blank" title="https://webmail.cbxnet.combox.group/www.cbxnet.de
Klicken Sie auf den Link, um die URL in einem neuen Fenster zu öffnen." rel="noopener">www.cbxnet.de</a><br></p><p>Rechenzentren für sichere Geschäftsanwendungen<br>Tel: +49 (30) 5900 69-80<br><a href="https://combox.bln.de/" target="_blank" title="https://combox.bln.de/
Klicken Sie auf den Link, um die URL in einem neuen Fenster zu öffnen." rel="noopener">https://combox.bln.de</a><br></p><p>Amtsgericht Berlin-Charlottenburg HRB 71171<br>Geschäftsführer: Stephan Höhn</p></div></div><div style="caret-color: rgb(0, 0, 0); font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; padding: 0px; margin: 0px; min-height: 11pt; font-family: arial, helvetica, sans-serif; font-size: 11pt;"><br></div><div style="caret-color: rgb(0, 0, 0); font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; padding: 0px; margin: 0px; min-height: 11pt; font-family: arial, helvetica, sans-serif; font-size: 11pt;"><br></div><blockquote style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; border-left-width: 2px; border-left-style: solid; border-left-color: rgb(50, 95, 186); padding-left: 5px; margin: 0px 5px;"><span style="font-family: tahoma, arial, helvetica, sans-serif; font-size: 10pt;">-----Ursprüngliche Nachricht-----<br><span><strong>Von:</strong><span class="Apple-converted-space"> </span>Taco Scargo <<a href="mailto:taco@blueonyx.nl">taco@blueonyx.nl</a>></span><br><span><strong>Gesendet:</strong><span class="Apple-converted-space"> </span>Dienstag 12. Dezember 2023 15:20</span><br><span><strong>An:</strong><span class="Apple-converted-space"> </span>Tobias Gablunsky <<a href="mailto:t.gablunsky@cbxnet.de">t.gablunsky@cbxnet.de</a>>; BlueOnyx General Mailing List <<a href="mailto:blueonyx@mail.blueonyx.it">blueonyx@mail.blueonyx.it</a>></span><br><span><strong>Betreff:</strong><span class="Apple-converted-space"> </span>Re: [BlueOnyx:26656] jquery warning</span><br><br></span>Hi Tobias,<div><br></div><div>As far as I know BlueOnyx doe not use jQuery 1.7.2 anywhere.</div><div>There is some use of jQuery in the BlueOnyx UI (including apps like phpMyAdmin), but they have different (newer) version numbers.</div><div><br></div><div>Can you share which location was identified and how you are sure it is not the website content?</div><div><br></div><div>Best regards,</div><div><br></div><div>Taco<br id="lineBreakAtBeginningOfMessage"><div><br><blockquote><div>On 12 Dec 2023, at 15:05, Tobias Gablunsky via Blueonyx <blueonyx@mail.blueonyx.it> wrote:</div><br class="Apple-interchange-newline"><div><div><div style="font-family: arial, helvetica, sans-serif; font-size: 11pt; padding: 0px; margin: 0px;">Hello,</div><div style="font-family: arial, helvetica, sans-serif; font-size: 11pt; padding: 0px; margin: 0px;"><span style="font-size: 11pt; font-family: arial, helvetica, sans-serif;"><br></span></div><div style="font-family: arial, helvetica, sans-serif; font-size: 11pt; padding: 0px; margin: 0px;"><span style="font-size: 11pt; font-family: arial, helvetica, sans-serif;">a customer of ours has initiated a vulnerability scan of his website. An outcome of this is a warning of a vulnerable Version of jQuery: "jQueryJS 1.7.2". This version seems to be part of BlueOnyx itself.</span></div><div style="font-family: arial, helvetica, sans-serif; font-size: 11pt; padding: 0px; margin: 0px;"><span style="font-size: 11pt; font-family: arial, helvetica, sans-serif;"><br></span></div><div style="font-family: arial, helvetica, sans-serif; font-size: 11pt; padding: 0px; margin: 0px;"><span style="font-size: 11pt; font-family: arial, helvetica, sans-serif;">Short question: is it possible to update this to eliminate this warning? </span></div><div style="font-family: arial, helvetica, sans-serif; font-size: 11pt; padding: 0px; margin: 0px;"><br></div><div class="signatureContainer"><div class="signature"><p style="padding: 0px; margin: 0px;"><span style="font-size: 11pt; font-family: arial, helvetica, sans-serif;"></span></p><p style="padding: 0px; margin: 0px;"></p><p style="padding: 0px; margin: 0px;"></p><p style="padding: 0px; margin: 0px;"></p><p style="padding: 0px; margin: 0px;"></p><p style="padding: 0px; margin: 0px;"></p><p style="padding: 0px; margin: 0px;"></p><p style="padding: 0px; margin: 0px;"></p><p style="padding: 0px; margin: 0px;"></p><p style="padding: 0px; margin: 0px;"></p><p style="padding: 0px; margin: 0px;"></p><p style="padding: 0px; margin: 0px;"></p><p style="padding: 0px; margin: 0px;"></p><p style="padding: 0px; margin: 0px;"></p><p style="padding: 0px; margin: 0px;"></p><p style="padding: 0px; margin: 0px;"></p><p style="padding: 0px; margin: 0px;"></p><p style="padding: 0px; margin: 0px;"></p><p style="padding: 0px; margin: 0px;"></p><p style="padding: 0px; margin: 0px;"></p><p style="padding: 0px; margin: 0px;"></p><p style="padding: 0px; margin: 0px;"></p><p style="padding: 0px; margin: 0px;"></p><p style="padding: 0px; margin: 0px;"></p><p style="padding: 0px; margin: 0px;"></p><p style="padding: 0px; margin: 0px;"></p><p style="padding: 0px; margin: 0px;"></p><p style="padding: 0px; margin: 0px;"></p><p style="padding: 0px; margin: 0px;"></p><p style="padding: 0px; margin: 0px;"></p><p style="padding: 0px; margin: 0px;"></p><p style="padding: 0px; margin: 0px;"></p><div style="margin: 0px;">Viele Grüße,<br>i.A. Tobias Gablunsky<br>IT-Infrastruktur & Lösungen<br>____________________________________________<br>CBXNET combox internet GmbH<br>Landhausstr. 22 | 10717 Berlin<br>Tel: +49 (30) 5900 69-00<br>Fax: +49 (30) 5900 69-99<br><a href="https://webmail.cbxnet.combox.group/www.cbxnet.de" target="_blank" title="https://webmail.cbxnet.combox.group/www.cbxnet.de
Klicken Sie auf den Link, um die URL in einem neuen Fenster zu öffnen." rel="noopener">www.cbxnet.de</a><br></div><div style="margin: 0px;">Rechenzentren für sichere Geschäftsanwendungen<br>Tel: +49 (30) 5900 69-80<br><a href="https://combox.bln.de/" target="_blank" title="https://combox.bln.de/
Klicken Sie auf den Link, um die URL in einem neuen Fenster zu öffnen." rel="noopener">https://combox.bln.de</a><br></div><div style="margin: 0px;">Amtsgericht Berlin-Charlottenburg HRB 71171<br>Geschäftsführer: Stephan Höhn</div></div></div><div style="padding: 0px; margin: 0px; min-height: 11pt; font-family: arial, helvetica, sans-serif; font-size: 11pt;"><span style="font-size: 11pt; font-family: arial, helvetica, sans-serif;"><br></span></div></div>_______________________________________________<br>Blueonyx mailing list<br><a href="mailto:Blueonyx@mail.blueonyx.it">Blueonyx@mail.blueonyx.it</a><br><a href="http://mail.blueonyx.it/mailman/listinfo/blueonyx">http://mail.blueonyx.it/mailman/listinfo/blueonyx</a></div></blockquote></div></div></blockquote></div></blockquote></div><br></div></div></body></html>