Hi Vivek,

Like I said, you cannot upgrade the existing 1.8.2 jQuery version which the platform uses by default.

You can only integrate a new jQuery version as a plugin which you could then use in your applications.

Did you take a look at the link I shared with you? It also contains a demo application as an attachment which shows how to integrate with jQuery 3.2.1.

Regards,

Nordin

Hi Vivek,

I tried to explain to you a couple of times. It is not possible to upgrade/replace jQuery 1.8.3 version with the 3.2.1 version. 

OutSystems does not allow us to upgrade the platform's default jQuery version since it could break internal components.

The only way to use a different jQuery version is by following the instructions in this post I shared with you earlier.

Regards,

Nordin

Nordin, we are failing PCI scans due to the ancient version of jQuery used by Outsystems.  What is the plan from Outsystems to address this?  Is there a plan to updrade it in the base platform?  

Here is just one example:  http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-9251 

Thanks,

Tom Juncewicz

Hi Tom,

OutSystems has already addressed the known vulnerabilities that were present in this jQuery version 1.8.3 a while ago, so it is considered a false positive.

Whether or not there is a plan to upgrade the default jQuery version that comes with the platform, I cannot answer. You would have to contact OutSystems support in order to get an answer to that question.

Regards,

Nordin

Thanks Nordin, unfortunately, there are newer CVE's since the "patching" of 1.8.3 (in 2020), namely:  http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11022 and http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11023 .   

I'll reach out to support on this topic.

Thanks.

Tom Juncewicz

You should do that Tom. It would be great if you can report back here after.

Thanks,

Nordin

Hi Tom,

Has there been any further development on this upon reaching out to OutSystems support.  It's something we also have to address within our application.

Kind regards,

Paul

Hello All,

Has there been any further development on this upon reaching out to OutSystems support? Although this is marked as false positive but this version is failing security scans on every attempt and it is hard to explain to clients why it is a false positive, there have been newer CVEs as well.

Appreciate if any help can be provided.