GitHub Advisoryadvisory · npm, RubyGems, Maven, NuGet

GHSA-qqxp-xp9v-vvx6 jquery-ui Tooltip widget vulnerable to XSS

MEDIUM Published 2017-10-24 Modified 2025-04-14 Official page ↗
Aliases
CVE-2012-6662
Ecosystem
npm, RubyGems, Maven, NuGet
Packages
jquery-ui, jquery-ui-rails, org.webjars.npm:jquery-ui, jQuery.UI.Combined
Severity
Moderate
Weaknesses
CWE-79
Reviewed
2020-06-16

Affected packages

• npm jquery-ui: < 1.10.0 → fixed in 1.10.0 • RubyGems jquery-ui-rails: < 4.0.0 → fixed in 4.0.0 • Maven org.webjars.npm:jquery-ui: < 1.10.0 → fixed in 1.10.0 • NuGet jQuery.UI.Combined: < 1.10.0 → fixed in 1.10.0

Description

Cross-site scripting (XSS) vulnerability in the default content option in jquery.ui.tooltip.js in the Tooltip widget in jQuery UI before 1.10.0 allows remote attackers to inject arbitrary web script or HTML via the title attribute, which is not properly handled in the autocomplete combo box demo.

Related

Alias · CVE (1)

  • CVE-2012-6662 Cross-site scripting (XSS) vulnerability in the default content option in jquery.ui.tooltip.js in the Tooltip widget in jQuery UI before… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References