NNA JQuery Vulnerability

[oslec]

Hi,

Im installed NNA in a customer for implementation in Trial, the customer do a scan of vulnerability to the server and tell me the next:

JQuery 1.2 < 3.5.0 Multiple XSS

URL : https://10.150.57.26/nagiosna/media/js/ ... 2.4.min.js
Installed version : 1.12.4
Fixed version : 3.5.0

My customer tell me if this version in a future can be change to JQuery major version.

Question: Do you have an ETA for resolving the version of JQuery in NA ?

Regards,

[benjaminsmith]

Hi @oslec,

Thanks for trying out Nagios Network Analyzer. Yes, this will be updated in the next maintenance release. However, I do not have a hard release date at the moment.

In the meantime, there is a workaround to address this specific CVE, if your customer is willing to patch this. Let m know if that is an option.

Potential XSS vulnerability in jQuery.htmlPrefilter and related methods

Benjamin