jquery-ui Tooltip widget vulnerable to XSS

2017-10-2418:33:37

CWE-79

GitHub Advisory Database

github.com

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

EPSS

0.003

Percentile

66.0%

JSON

Cross-site scripting (XSS) vulnerability in the default content option in jquery.ui.tooltip.js in the Tooltip widget in jQuery UI before 1.10.0 allows remote attackers to inject arbitrary web script or HTML via the title attribute, which is not properly handled in the autocomplete combo box demo.

Affected configurations

Vulners

Node

jquery.ui.combinedRange<1.10.0

org.webjars.npmjquery-uiRange<1.10.0

jqueryuijquery_uiRange<4.0.0jquery

jqueryuijquery_uiRange<1.10.0jquery

VendorProductVersionCPE
*jquery.ui.combined*cpe:2.3:a:*:jquery.ui.combined:*:*:*:*:*:*:*:*
org.webjars.npmjquery-ui*cpe:2.3:a:org.webjars.npm:jquery-ui:*:*:*:*:*:*:*:*
jqueryuijquery_ui*cpe:2.3:a:jqueryui:jquery_ui:*:*:*:*:*:jquery:*:*

Vendor	Product	Version	CPE
*	jquery.ui.combined	*	cpe:2.3:a::jquery.ui.combined::::::::*
org.webjars.npm	jquery-ui	*	cpe:2.3:a:org.webjars.npm:jquery-ui::::::::
jqueryui	jquery_ui	*	cpe:2.3:a:jqueryui:jquery_ui::::::jquery::*