CVE-2016-7103 jQuery-UI vulnerable to Cross-site Scripting in dialog closeText

MediumCVSS 6.1 EPSS 29.2% PoC

Published: 2017-03-15 16:01 (approximate time: when CVE Radar first recorded it)
Updated: 2026-11-03 08:30
Exploit status: Proof-of-concept only

Description

Cross-site scripting (XSS) vulnerability in jQuery UI before 1.12.0 might allow remote attackers to inject arbitrary web script or HTML via the closeText parameter of the dialog function.

Affected products

Product	Affected versions	Fixed in
npm jquery-ui(npm)	< 1.12.0	1.12.0
rubygems jquery-ui-rails(RubyGems)	< 6.0.0	6.0.0
org.webjars.npm/jquery-ui(Maven)	< 1.12.0	1.12.0
nuget jQuery.UI.Combined(NuGet)	< 1.12.0	1.12.0
rubygems jquery-ui-rails(RubyGems)	= 0.0.1	No fix listed
rubygems jquery-ui-rails(RubyGems)	= 0.0.2	No fix listed
rubygems jquery-ui-rails(RubyGems)	= 0.1.0	No fix listed
rubygems jquery-ui-rails(RubyGems)	= 0.2.0	No fix listed
rubygems jquery-ui-rails(RubyGems)	= 0.2.1	No fix listed
rubygems jquery-ui-rails(RubyGems)	= 0.2.2	No fix listed
rubygems jquery-ui-rails(RubyGems)	= 0.3.0	No fix listed
rubygems jquery-ui-rails(RubyGems)	= 0.4.0	No fix listed
rubygems jquery-ui-rails(RubyGems)	= 0.4.1	No fix listed
rubygems jquery-ui-rails(RubyGems)	= 0.5.0	No fix listed
rubygems jquery-ui-rails(RubyGems)	= 1.0.0	No fix listed
rubygems jquery-ui-rails(RubyGems)	= 1.1.0	No fix listed
rubygems jquery-ui-rails(RubyGems)	= 1.1.1	No fix listed
rubygems jquery-ui-rails(RubyGems)	= 2.0.0	No fix listed
rubygems jquery-ui-rails(RubyGems)	= 2.0.1	No fix listed
rubygems jquery-ui-rails(RubyGems)	= 2.0.2	No fix listed
rubygems jquery-ui-rails(RubyGems)	= 3.0.0	No fix listed
rubygems jquery-ui-rails(RubyGems)	= 3.0.1	No fix listed
rubygems jquery-ui-rails(RubyGems)	= 4.0.0	No fix listed
rubygems jquery-ui-rails(RubyGems)	= 4.0.1	No fix listed
rubygems jquery-ui-rails(RubyGems)	= 4.0.2	No fix listed

Show 80 more

Product	Affected versions	Fixed in
rubygems jquery-ui-rails(RubyGems)	= 4.0.3	No fix listed
rubygems jquery-ui-rails(RubyGems)	= 4.0.4	No fix listed
rubygems jquery-ui-rails(RubyGems)	= 4.0.5	No fix listed
rubygems jquery-ui-rails(RubyGems)	= 4.1.0	No fix listed
rubygems jquery-ui-rails(RubyGems)	= 4.1.1	No fix listed
rubygems jquery-ui-rails(RubyGems)	= 4.1.2	No fix listed
rubygems jquery-ui-rails(RubyGems)	= 4.2.0	No fix listed
rubygems jquery-ui-rails(RubyGems)	= 4.2.1	No fix listed
rubygems jquery-ui-rails(RubyGems)	= 5.0.0	No fix listed
rubygems jquery-ui-rails(RubyGems)	= 5.0.1	No fix listed
rubygems jquery-ui-rails(RubyGems)	= 5.0.2	No fix listed
rubygems jquery-ui-rails(RubyGems)	= 5.0.3	No fix listed
rubygems jquery-ui-rails(RubyGems)	= 5.0.4	No fix listed
rubygems jquery-ui-rails(RubyGems)	= 5.0.5	No fix listed
org.webjars.npm/jquery-ui(Maven)	= 1.10.4	No fix listed
org.webjars.npm/jquery-ui(Maven)	= 1.10.5	No fix listed
org.webjars.npm/jquery-ui(Maven)	= 1.12.0-rc.2	No fix listed
nuget jQuery.UI.Combined(NuGet)	= 1.10.0	No fix listed
nuget jQuery.UI.Combined(NuGet)	= 1.10.1	No fix listed
nuget jQuery.UI.Combined(NuGet)	= 1.10.2	No fix listed
nuget jQuery.UI.Combined(NuGet)	= 1.10.3	No fix listed
nuget jQuery.UI.Combined(NuGet)	= 1.10.4	No fix listed
nuget jQuery.UI.Combined(NuGet)	= 1.11.0	No fix listed
nuget jQuery.UI.Combined(NuGet)	= 1.11.1	No fix listed
nuget jQuery.UI.Combined(NuGet)	= 1.11.2	No fix listed
nuget jQuery.UI.Combined(NuGet)	= 1.11.3	No fix listed
nuget jQuery.UI.Combined(NuGet)	= 1.11.4	No fix listed
nuget jQuery.UI.Combined(NuGet)	= 1.8.10	No fix listed
nuget jQuery.UI.Combined(NuGet)	= 1.8.11	No fix listed
nuget jQuery.UI.Combined(NuGet)	= 1.8.12	No fix listed
nuget jQuery.UI.Combined(NuGet)	= 1.8.13	No fix listed
nuget jQuery.UI.Combined(NuGet)	= 1.8.14	No fix listed
nuget jQuery.UI.Combined(NuGet)	= 1.8.15	No fix listed
nuget jQuery.UI.Combined(NuGet)	= 1.8.16	No fix listed
nuget jQuery.UI.Combined(NuGet)	= 1.8.17	No fix listed
nuget jQuery.UI.Combined(NuGet)	= 1.8.18	No fix listed
nuget jQuery.UI.Combined(NuGet)	= 1.8.19	No fix listed
nuget jQuery.UI.Combined(NuGet)	= 1.8.20	No fix listed
nuget jQuery.UI.Combined(NuGet)	= 1.8.20.1	No fix listed
nuget jQuery.UI.Combined(NuGet)	= 1.8.21	No fix listed
nuget jQuery.UI.Combined(NuGet)	= 1.8.22	No fix listed
nuget jQuery.UI.Combined(NuGet)	= 1.8.23	No fix listed
nuget jQuery.UI.Combined(NuGet)	= 1.8.24	No fix listed
nuget jQuery.UI.Combined(NuGet)	= 1.8.9	No fix listed
nuget jQuery.UI.Combined(NuGet)	= 1.9.0	No fix listed
nuget jQuery.UI.Combined(NuGet)	= 1.9.0-RC1	No fix listed
nuget jQuery.UI.Combined(NuGet)	= 1.9.1	No fix listed
nuget jQuery.UI.Combined(NuGet)	= 1.9.2	No fix listed
debian/jqueryui(Debian:12)	< 1.12.1+dfsg-1	1.12.1+dfsg-1
debian/jqueryui(Debian:13)	< 1.12.1+dfsg-1	1.12.1+dfsg-1
debian/jqueryui(Debian:14)	< 1.12.1+dfsg-1	1.12.1+dfsg-1
jqueryui jquery ui	>= 1.10.0, <= 1.11.4	No fix listed
oracle application express	< 19.1	19.1
oracle business intelligence	= 12.2.1.3.0	No fix listed
oracle business intelligence	= 12.2.1.4.0	No fix listed
oracle hospitality cruise fleet management	= 9.0.11	No fix listed
oracle oss support tools	< 2.12.42	2.12.42
oracle oss support tools	= 2.12.42	No fix listed
oracle primavera unifier	>= 16.0, <= 16.2	No fix listed
oracle primavera unifier	>= 17.0, <= 17.12.4	No fix listed
oracle primavera unifier	>= 18.0, <= 18.8.4	No fix listed
oracle siebel ui framework	<= 21.2	No fix listed
oracle weblogic server	= 10.3.6.0.0	No fix listed
oracle weblogic server	= 12.1.3.0.0	No fix listed
oracle weblogic server	= 12.2.1.3.0	No fix listed
fedoraproject fedora	= 30	No fix listed
fedoraproject fedora	= 35	No fix listed
fedoraproject fedora	= 36	No fix listed
netapp snapcenter	All versions	No fix listed
redhat openstack	= 7.0	No fix listed
redhat openstack	= 8	No fix listed
redhat openstack	= 9	No fix listed
juniper junos	= 21.2	No fix listed
debian linux	= 9.0	No fix listed
alpine/drupal7(Alpine:v3.15)	< 7.86-r0	7.86-r0
alpine/drupal7(Alpine:v3.16)	< 7.86-r0	7.86-r0
alpine/drupal7(Alpine:v3.17)	< 7.86-r0	7.86-r0
alpine/drupal7(Alpine:v3.18)	< 7.86-r0	7.86-r0
alpine/drupal7(Alpine:v3.19)	< 7.86-r0	7.86-r0
alpine/drupal7(Alpine:v3.20)	< 7.86-r0	7.86-r0

References

nvd.nist.gov third-party-advisory vendor-advisory
github.com patch
github.com exploit issue-tracking patch third-party-advisory
github.com patch third-party-advisory
jqueryui.com release-notes vendor-advisory
lists.apache.org
lists.apache.org
lists.apache.org
lists.apache.org
lists.apache.org
lists.fedoraproject.org
security.netapp.com third-party-advisory
www.oracle.com third-party-advisory
www.oracle.com third-party-advisory
www.oracle.com patch third-party-advisory
www.oracle.com patch third-party-advisory
www.oracle.com patch third-party-advisory
RHSA-2016:2932 third-party-advisory vendor-advisory
RHSA-2016:2933 third-party-advisory vendor-advisory
RHSA-2017:0161 third-party-advisory vdb-entry vendor-advisory
www.oracle.com patch third-party-advisory
www.oracle.com third-party-advisory
[debian-lts-announce] 20220119 [SECURITY] [DLA-2889-1] drupal7 security update mailing-list third-party-advisory
www.drupal.org third-party-advisory
www.oracle.com third-party-advisory
lists.fedoraproject.org
lists.fedoraproject.org
[drill-dev] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities mailing-list third-party-advisory
[drill-dev] 20191017 Dependencies used by Drill contain known vulnerabilities mailing-list third-party-advisory
[roller-commits] 20190820 [jira] [Created] (ROL-2150) Fix Js security vulnerabilities detected using retire js mailing-list third-party-advisory
[drill-issues] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities mailing-list third-party-advisory
[pulsar-commits] 20190416 [GitHub] [pulsar] one70six opened a new issue #4057: Security Vulnerabilities - Black Duck Scan - Pulsar v.2.3.1 mailing-list third-party-advisory
FEDORA-2019-a96124345a mailing-list third-party-advisory vendor-advisory
FEDORA-2022-9d655503ea mailing-list third-party-advisory vendor-advisory
FEDORA-2022-bf18450366 mailing-list third-party-advisory vendor-advisory
github.com patch
web.archive.org
github.com exploit
github.com
github.com product
Debian Security Tracker CVE-2016-7103 vendor-advisory
104823 broken-link third-party-advisory vdb-entry
nodesecurity.io third-party-advisory
www.tenable.com third-party-advisory
security.alpinelinux.org vendor-advisory

CVSS v3.1

6.1 Medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
User Interaction: Required
Scope: Changed
Confidentiality: Low
Integrity: Low
Availability: None

All scores (6)

v3.1 6.1 · nvd@nist.gov
v3.1 6.1 · osv:alpine
v3.1 6.1 · osv:ghsa
v3.1 6.1 · github
v3.1 6.1 · osv:debian
v2.0 4.3 · nvd@nist.gov

Weakness & likelihood

EPSS (exploitation probability, 30 days): 29.19% (percentile 98.2)
CWE: CWE-79 Improper Neutralization of Input During Web Page Generation

Public exploit references

Metadata only. CVERadar never hosts or runs exploit code.

Proof of concept: github.com/rubysec/ruby-advisory-db/blob/master/gems/jquery-ui-rails/CVE-2016-7103.yml PoC · GitHub public repositories · 2026-11-11