jquery-ui Tooltip widget vulnerable to XSS

CVE-2012-6662 → View on GitHub ↗ View on CVE.org ↗ View on NVD ↗

Description

Cross-site scripting (XSS) vulnerability in the default content option in jquery.ui.tooltip.js in the Tooltip widget in jQuery UI before 1.10.0 allows remote attackers to inject arbitrary web script or HTML via the title attribute, which is not properly handled in the autocomplete combo box demo.

Basic information

Type
reviewed
Severity
medium
Advisory on GitHub
Open advisory ↗
Repository advisory
—
Source code
Browse source ↗
Published (advisory)
2017-10-24 18:33:37 UTC
Updated
2023-11-09 05:04:01 UTC
GitHub reviewed
2020-06-16 21:52:37 UTC
NVD published
2014-11-24

EPSS Score

Score Percentile
7.05% 91.50%

CVSS Scores

No CVSS scores in this advisory.

Identifiers

Type Value
GHSA GHSA-qqxp-xp9v-vvx6 ↗
CVE CVE-2012-6662 ↗

CWEs

CWE id Name
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected packages (4)

Vulnerable version ranges and first patched releases as published by GitHub.

Ecosystem Package Vulnerable range First patched Vulnerable functions
npm jquery-ui < 1.10.0 1.10.0 —
rubygems jquery-ui-rails < 4.0.0 4.0.0 —
maven org.webjars.npm:jquery-ui < 1.10.0 1.10.0 —
nuget jQuery.UI.Combined < 1.10.0 1.10.0 —

References

cvelogic Threat Intelligence