Vulnerability Assessment Remediation Suggtions

[dudedowne]

Hello All,
Another Joomla newb here seeking advice. Our network team recently ran a preliminary SecuMetr vulnerability assessment and found the following on our Joomla 3.10.3 implementation. I know that 3.10.4 just was released and we are currently testing J4 compatibility but are not quite ready to move there yet.

Here are the detected vulnerabilities. I was able to find solutions for the ones that are crossed out. However, the other items didn't seem to yield any applicable workarounds.

vulnerabilities.png

CGI Generic Command Execution (time-based)
JQuery 1.2 < 3.5.0 Multiple XSS
JQuery < 3.4.0 Object Prototype Pollution Vulnerability
JQuery < 3.0.0 XSS

Thanks again for any advice,
DD

[pmleconte]

Hi,

If you take a look at media/jui/js/jquery.js, just read the top lines and you'll see that this has been fixed by Joomla team at least 2 years ago.

I wrote "2 years ago" by looking https://github.com/joomla/joomla-cms/tr ... dia/jui/js which gives you the last update date for jquery.js.

Pascal

[dudedowne]

pmleconte,

Thanks for the reply. I am assuming it is a false positive, but not sure how to verify. The tool definitely shows juquery.min.js reporting version 1.12.4 and not the current version of 3.5.0. Is this expected?

Much appreciated!
DD

[brian]

You can check by reading the file and seeing the comment at the top of the file