CVE-2012-6662 jquery-ui Tooltip widget vulnerable to XSS
MediumCVSS 4.3
EPSS 7.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Cross-site scripting (XSS) vulnerability in the default content option in jquery.ui.tooltip.js in the Tooltip widget in jQuery UI before 1.10.0 allows remote attackers to inject arbitrary web script or HTML via the title attribute, which is not properly handled in the autocomplete combo box demo.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| npm jquery-ui(npm) | < 1.10.0 | 1.10.0 |
| rubygems jquery-ui-rails(RubyGems) | < 4.0.0 | 4.0.0 |
| org.webjars.npm/jquery-ui(Maven) | < 1.10.0 | 1.10.0 |
| nuget jQuery.UI.Combined(NuGet) | < 1.10.0 | 1.10.0 |
| rubygems jquery-ui-rails(RubyGems) | = 0.0.1 | No fix listed |
| rubygems jquery-ui-rails(RubyGems) | = 0.0.2 | No fix listed |
| rubygems jquery-ui-rails(RubyGems) | = 0.1.0 | No fix listed |
| rubygems jquery-ui-rails(RubyGems) | = 0.2.0 | No fix listed |
| rubygems jquery-ui-rails(RubyGems) | = 0.2.1 | No fix listed |
| rubygems jquery-ui-rails(RubyGems) | = 0.2.2 | No fix listed |
| rubygems jquery-ui-rails(RubyGems) | = 0.3.0 | No fix listed |
| rubygems jquery-ui-rails(RubyGems) | = 0.4.0 | No fix listed |
| rubygems jquery-ui-rails(RubyGems) | = 0.4.1 | No fix listed |
| rubygems jquery-ui-rails(RubyGems) | = 0.5.0 | No fix listed |
| rubygems jquery-ui-rails(RubyGems) | = 1.0.0 | No fix listed |
| rubygems jquery-ui-rails(RubyGems) | = 1.1.0 | No fix listed |
| rubygems jquery-ui-rails(RubyGems) | = 1.1.1 | No fix listed |
| rubygems jquery-ui-rails(RubyGems) | = 2.0.0 | No fix listed |
| rubygems jquery-ui-rails(RubyGems) | = 2.0.1 | No fix listed |
| rubygems jquery-ui-rails(RubyGems) | = 2.0.2 | No fix listed |
| rubygems jquery-ui-rails(RubyGems) | = 3.0.0 | No fix listed |
| rubygems jquery-ui-rails(RubyGems) | = 3.0.1 | No fix listed |
| nuget jQuery.UI.Combined(NuGet) | = 1.8.10 | No fix listed |
| nuget jQuery.UI.Combined(NuGet) | = 1.8.11 | No fix listed |
| nuget jQuery.UI.Combined(NuGet) | = 1.8.12 | No fix listed |
Show 26 more
| Product | Affected versions | Fixed in |
|---|---|---|
| nuget jQuery.UI.Combined(NuGet) | = 1.8.13 | No fix listed |
| nuget jQuery.UI.Combined(NuGet) | = 1.8.14 | No fix listed |
| nuget jQuery.UI.Combined(NuGet) | = 1.8.15 | No fix listed |
| nuget jQuery.UI.Combined(NuGet) | = 1.8.16 | No fix listed |
| nuget jQuery.UI.Combined(NuGet) | = 1.8.17 | No fix listed |
| nuget jQuery.UI.Combined(NuGet) | = 1.8.18 | No fix listed |
| nuget jQuery.UI.Combined(NuGet) | = 1.8.19 | No fix listed |
| nuget jQuery.UI.Combined(NuGet) | = 1.8.20 | No fix listed |
| nuget jQuery.UI.Combined(NuGet) | = 1.8.20.1 | No fix listed |
| nuget jQuery.UI.Combined(NuGet) | = 1.8.21 | No fix listed |
| nuget jQuery.UI.Combined(NuGet) | = 1.8.22 | No fix listed |
| nuget jQuery.UI.Combined(NuGet) | = 1.8.23 | No fix listed |
| nuget jQuery.UI.Combined(NuGet) | = 1.8.24 | No fix listed |
| nuget jQuery.UI.Combined(NuGet) | = 1.8.9 | No fix listed |
| nuget jQuery.UI.Combined(NuGet) | = 1.9.0 | No fix listed |
| nuget jQuery.UI.Combined(NuGet) | = 1.9.0-RC1 | No fix listed |
| nuget jQuery.UI.Combined(NuGet) | = 1.9.1 | No fix listed |
| nuget jQuery.UI.Combined(NuGet) | = 1.9.2 | No fix listed |
| debian/jqueryui(Debian:12) | < 1.10.1+dfsg-1 | 1.10.1+dfsg-1 |
| debian/jqueryui(Debian:13) | < 1.10.1+dfsg-1 | 1.10.1+dfsg-1 |
| debian/jqueryui(Debian:14) | < 1.10.1+dfsg-1 | 1.10.1+dfsg-1 |
| redhat enterprise linux desktop | = 7.0 | No fix listed |
| redhat enterprise linux hpc node | = 7.0 | No fix listed |
| redhat enterprise linux server | = 7.0 | No fix listed |
| redhat enterprise linux workstation | = 7.0 | No fix listed |
| jqueryui jquery ui | = 1.10.0-rc1 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com
- github.com issue-tracking patch third-party-advisory
- github.com issue-tracking patch third-party-advisory
- jqueryui-cve20126662-xss(98697) vdb-entry
- bugs.jqueryui.com issue-tracking vendor-advisory
- bugs.jqueryui.com issue-tracking vendor-advisory
- RHSA-2015:0442 third-party-advisory vendor-advisory
- RHSA-2015:1462 vendor-advisory
- [oss-security] 20141114 old CVE assignments for JQuery 1.10.0 mailing-list third-party-advisory vdb-entry
- [oss-security] 20141114 Re: old CVE assignments for JQuery 1.10.0 mailing-list third-party-advisory vdb-entry
- github.com exploit
- github.com
- github.com product
- Debian Security Tracker CVE-2012-6662 vendor-advisory
- 71107 vdb-entry