DNN 8.0.3.5 jQuery 1.9.1 Security Issue

Question

We are currently failing a security audit due to the following: https://github.com/jquery/jquery/issues/2432

Looking at the following folder structure of our install, it seems that jQuery v1.9.1 is installed out of the box: \Resources\Libraries\jQuery\01_09_01

It would also seem that there is no set way to upgrade the version of jQuery. We must upgrade to v3.0.0 or better. I used this guide to get around the upgrade problem. Unfortunately this breaks the admin with jQuery versions v3.3.1 and v3.0.0 - browser scrolling stopped working as well as pop-ups. For example, cannot uninstall/install an extension.

Can anyone suggest a solution?

The last 1x version of jQuery that was published, or at least that I see in google cdn, is `1.12.4`. Have you tried upgrading your 1x version past 1.9.1 to see if the issue persists? — Taplar, May 30 '18 at 20:59
Taplar, no but my understanding is that the security flaw is only fixed in versions 3x up? https://github.com/jquery/jquery/issues/2432 — IrishChieftain, May 30 '18 at 21:01
Aaah, yes, I see that near the end. You appear to be correct. — Taplar, May 30 '18 at 21:04
Fix the admin issues and submit a patch? DDN is open source, right? — dana, May 31 '18 at 12:02

score 0 · Accepted Answer · answered May 31 '18 at 11:58

0

You might want to send an email to security@dnnsoftware.com and see what they suggest.

answered May 31 '18 at 11:58

Joe Craig

1,244
1
7
7

Thanks for the suggestion Joe. Just sent it. – IrishChieftain May 31 '18 at 18:49

DNN 8.0.3.5 jQuery 1.9.1 Security Issue

1 Answers1