0

Recently we have made pen-test on Magento 2.3.3 version.

We have received the following issues.

Vulnerable Javascript Library Versions In Use

adminhtml/Magento/backend/en_US/jquery/jquery-ui-1.9.2.js adminhtml/Magento/backend/en_US/knockoutjs/knockout.js adminhtml/Magento/backend/en_US/jquery.js

Can we upgrade these library files to latest versions?

How this can be achieved? Can anyone help me with the steps to implement it.

Thanks in Advance!!

Improve this question

1 Answer 1

Reset to default
1

Go to app\design\frontend\Vendor\Theme\Magento_Theme\layout\default_head_blocks.xml. create if not exist

 <page xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="urn:magento:framework:View/Layout/etc/page_configuration.xsd">
<head>
    <!--Remove default jquery, or it will cause conflict-->
    <remove src="lib\web\jquery\jquery.js"/>
    <remove src="lib\web\knockoutjs\knockoutjs.js"/>
    <remove src="lib\web\jquery\jquery-ui.js"/>
    <!--Include CDN-->
    <script
          src="https://code.jquery.com/jquery-3.2.1.min.js"
          integrity="sha256-hwg4gsxgFZhOsEEamdOYGBf13FyQuiTwlAQgxVSNgt4="
          crossorigin="anonymous" src_type="url"></script>
    <script
          src="https://cdnjs.cloudflare.com/ajax/libs/knockout/3.5.0/knockout-debug.js"
          integrity="sha256-hwg4gsxgFZhOsEEamdOYGBf13FyQuiTwlAQgxVSNgt4="
          crossorigin="anonymous" src_type="url"></script>

    <script
          src="https://cdnjs.cloudflare.com/ajax/libs/jqueryui/1.12.1/jquery-ui.js"
          integrity="sha256-hwg4gsxgFZhOsEEamdOYGBf13FyQuiTwlAQgxVSNgt4="
          crossorigin="anonymous" src_type="url"></script>
</head>
Improve this answer
11
  • hi @Divyesh, what about knockoutjs and jquery-ui file? how can we upgrade them?
    – Jafar Pinjar
    Commented Oct 30, 2019 at 11:31
  • same you can try with knockout .
    – Divyesh
    Commented Oct 30, 2019 at 11:39
  • can you pls update code for other 2 js as well?
    – Jafar Pinjar
    Commented Oct 30, 2019 at 11:43
  • check updated answer @jafarpinjar
    – Divyesh
    Commented Oct 30, 2019 at 11:48
  • okay let me try this.
    – Jafar Pinjar
    Commented Oct 30, 2019 at 11:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.