jQuery UI – CVE-2012-6662

Description

Kayran has detected that the version of jQuery UI being used is vulnerable to Cross-site scripting (XSS).
This can be done by abusing the jquery.ui.tooltip.js. Also known as CVE-2012-6662.

By abusing the jquery.ui.tooltip.js in the Tooltip widget in jQuery UI, remote attackers can inject arbitrary web scripts or any HTML.
This is done via the title attribute, which is not properly handled in the autocomplete combo box demo.

Severity/Score

CVSS Version 2.0 – 4.3 Medium

Recommendation

To fix CVE-2012-6662, update the version of the jQuery UI being used.
Make sure its version is 1.10.0 or higher.

References

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-6662

https://cwe.mitre.org/data/definitions/79.html

< Return to all Vulnerabilities

Crossing Scripts – XSS

Injections. SQL Injections. Cross-site Scripting (hence the amazing title “Crossing Scripts – XSS”). There all sorts of Injection-Based attacks, if you want to read about

Read More »

Servers 101

Let’s have a “quick” Servers 101 Course. Courtesy of Kayran! If you’ve been on the internet for over an hour, you probably already heard of

Read More »