CVE-2012-6662 jquery-ui Tooltip widget vulnerable to XSS
Remote attackers can inject arbitrary web script or HTML via the title attribute in the jQuery UI Tooltip widget, requiring user interaction to execute.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2012-6662?
CVE-2012-6662 is a medium-severity cross-site scripting vulnerability in Redhat Enterprise Linux Desktop, published on 24 Nov 2014. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Cross-site scripting (XSS) vulnerability in the default content option in jquery.ui.tooltip.js in the Tooltip widget in jQuery UI before 1.10.0 allows remote attackers to inject arbitrary web script or HTML via the title attribute, which is not properly handled in the autocomplete combo box demo.
Weakness: CWE-79
Which versions are affected by CVE-2012-6662?
8 open source packages ship an affected version, including org.webjars.npm:jquery-ui, jQuery.UI.Combined and jquery-ui-rails. It affects 5 products.
| Package | Affected | Fixed in |
|---|---|---|
org.webjars.npm:jquery-ui Maven | All versions | 1.10.0 |
org.webjars.npm:jquery-ui Maven | All versions | 1.10.0 |
jQuery.UI.Combined NuGet | All versions | 1.10.0 |
jQuery.UI.Combined NuGet | All versions | 1.10.0 |
jquery-ui-rails RubyGems | All versions | 4.0.0 |
jquery-ui-rails RubyGems | All versions | 4.0.0 |
2 more packages
jquery-ui npm | All versions | 1.10.0 |
jquery-ui npm | All versions | 1.10.0 |
Products include Jqueryui Jquery Ui, Redhat Enterprise Linux Desktop, Redhat Enterprise Linux Hpc Node, Redhat Enterprise Linux Server, Redhat Enterprise Linux Workstation.
How do I fix CVE-2012-6662?
Upgrade org.webjars.npm:jquery-ui to 1.10.0 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2012-6662 being exploited?
There is no known exploitation of CVE-2012-6662 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2012-6662, GHSA-qqxp-xp9v-vvx6.