CVE-2012-6662: Cross-Site Scripting (XSS) Vulnerability in jquery-ui
Summary
CVE-2012-6662: jquery-ui Tooltip widget vulnerable to XSS. Affects jquery-ui versions < 1.10.0. Fixed in 1.10.0. How to fix ↓
Also tracked for
- jqueryui · Debian:11
The same CVE-2012-6662 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
jQuery UI is a popular JavaScript library that provides a set of user interface interactions, effects, widgets, and themes for building web applications. It includes a Tooltip widget that allows developers to display informative tooltips when users hover over elements. However, versions of jQuery UI prior to 1.10.0 are vulnerable to a cross-site scripting (XSS) attack in the default content option of the Tooltip widget. This vulnerability can be exploited by remote attackers to inject arbitrary web script or HTML via the title attribute, which is not properly handled in the autocomplete combo box demo.
Vulnerability Detail
The vulnerability arises from a lack of proper input sanitization in the Tooltip widget's handling of the title attribute. By crafting a malicious title attribute value, an attacker can inject arbitrary script or HTML code into the affected web page. When unsuspecting users interact with the tooltip, the injected code will execute within their browser, potentially leading to session hijacking, data theft, or other malicious activities. This vulnerability is classified as moderate severity and has been assigned the CVE identifier CVE-2012-6662. The Common Weakness Enumeration (CWE) identifier for this vulnerability is CWE-79, which corresponds to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting').
How To Fix
Minimum fixed version
1.10.0
This is the first release that contains the fix.
npm install jquery-ui@1.10.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to a newer version of jQuery UI is not immediately feasible, a temporary workaround is to manually sanitize the title attribute value before passing it to the Tooltip widget. This can be done by using appropriate HTML encoding or escaping techniques to neutralize any potentially malicious script or HTML tags. Here is an example of how to sanitize the title attribute value using JavaScript:
var sanitizedTitle = $('<div>').text(title).html();
Conclusion
The cross-site scripting (XSS) vulnerability in the Tooltip widget of jQuery UI versions prior to 1.10.0 can allow remote attackers to inject arbitrary web script or HTML into affected web pages. To mitigate this vulnerability, it is crucial to upgrade to jQuery UI version 1.10.0 or later. Developers should also ensure that the Tooltip widget is configured securely. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for jquery-ui →
FAQ
The vulnerability allows remote attackers to inject arbitrary web script or HTML into affected web pages, potentially leading to session hijacking, data theft, or other malicious activities.
Versions of jQuery UI prior to 1.10.0 are affected by this vulnerability.
While specific exploits targeting this vulnerability may exist, they have not been disclosed publicly at the time of this report.
The recommended mitigation is to upgrade to jQuery UI version 1.10.0 or later, which includes proper input sanitization to prevent the XSS vulnerability.
You can find more information about this vulnerability in the official GitHub Advisory Database entry: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2017/10/GHSA-qqxp-xp9v-vvx6/GHSA-qqxp-xp9v-vvx6.json
References
Related vulnerabilities
Recent vulnerabilities recorded for jquery-ui.
