Subject: Vulnerability report - 3828
From: Dhruvi Pandya <[email-masked]>
To: [email-masked]
Date: Thu, 19 Jun 2025 17:46:12 +0530

*Hello Team,*

I, *Dhruvi Pandya*, have identified several vulnerabilities associated with
outdated third-party JavaScript libraries in use on your platform. These
libraries are being loaded from the following location:

*File:*
https://ssg-bce6beafhzh8hfen.z01.azurefd.net/scripts/s2.min.js?v=2.0

The libraries in use — *jQuery 2.2.3*, *Knockout 3.4.0*, and *Moment.js
2.15.2* — contain multiple known vulnerabilities ranging from *Cross-Site
Scripting (XSS)* and *Object Prototype Pollution*, to *Denial of Service
(DoS)* attacks.
------------------------------
Affected Libraries and Vulnerabilities
------------------------------
1. jQuery 2.2.3

   -

   *End-of-Life – Low*
   jQuery 1.x and 2.x are no longer supported or receiving security updates.
   -

   *CVE-2015-9251 – Medium*
   3rd party CORS request execution
   *GHSA-rmxg-73gg-4p98*
   -

   *CVE-2019-11358 – Medium*
   Prototype pollution via jQuery.extend(true, {}, ...)
   *GHSA-6c3j-c64m-qhgq*
   -

   *CVE-2020-11023 – Medium*
   Unsafe handling of <option> elements can lead to XSS
   *GHSA-jpcq-cgw6-v4j6*
   -

   *CVE-2020-11022 – Medium*
   Regex used in jQuery.htmlPrefilter can result in XSS
   *GHSA-gxr4-xjj5-5px2*

------------------------------
2. Knockout.js 3.4.0

   -

   *CVE-2019-14862 – Medium*
   XSS via attribute name bindings in older browsers like IE7
   *GHSA-vcjj-xf2r-mwvc*

------------------------------
3. Moment.js 2.15.2

   -

   *CVE-2017-18214 – High*
   Regular Expression Denial of Service (ReDoS) via crafted input
   *GHSA-446m-mv8f-q348*
   -

   *CVE-2022-24785 – High*
   Vulnerability in locale switching using user-controlled input
   *GHSA-8hfj-j24r-96c4*

------------------------------
Risk & Impact

These vulnerabilities may result in:

   -

   *Cross-Site Scripting (XSS):* Execution of malicious scripts in the
   user's browser
   -

   *Denial of Service (DoS):* Application unresponsiveness through regex or
   malformed input
   -

   *Object Prototype Pollution:* Leading to unexpected application behavior
   or access control bypass
   -

   *Information leakage or legacy browser-specific exploitation (e.g., IE7)*

Outdated libraries also pose a long-term maintenance and compliance risk
due to the lack of security patches.
------------------------------
Recommendations

   -

   *Upgrade jQuery to ≥3.6.0*, which resolves XSS and prototype pollution
   vulnerabilities.
   -

   *Upgrade Knockout.js to the latest stable version*, and avoid supporting
   insecure legacy browsers like IE7.
   -

   *Upgrade Moment.js to ≥2.29.4*, or consider replacing it with more
   secure and modern alternatives like *Day.js* or *date-fns*.
   -

   Conduct a *full dependency audit* to identify any other unsupported or
   unpatched libraries.
   -

   Implement a *strong Content Security Policy (CSP)* to reduce the impact
   of any potential client-side code injection.

------------------------------
Conclusion

Updating these widely-used libraries is crucial to maintaining the security
and resilience of your application. Left unpatched, these vulnerabilities
could be exploited in real-world attacks. Please let me know if you need
assistance with applying the fixes or validating their effectiveness.

*Best regards,*
*Dhruvi Pandya*