PT-2014-2424 · Jquery+2 · Jquery Ui+2

Homakov · Publicado 2014-11-24 · Atualizado 2025-06-17 · CVE-2012-6662

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions jQuery UI versions prior to 1.10.0

Description A cross-site scripting (XSS) issue exists in the default content option in jquery.ui.tooltip.js in the Tooltip widget. This allows remote attackers to inject arbitrary web script or HTML via the title attribute, which is not properly handled in the autocomplete combo box demo.

Recommendations For versions prior to 1.10.0, update to version 1.10.0 or later to resolve the issue. As a temporary workaround, consider disabling the use of the title attribute in the autocomplete combo box demo until a patch is available. Restrict access to the Tooltip widget to minimize the risk of exploitation. Avoid using the title attribute in the affected widget until the issue is resolved.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CESA-2015_0442

CESA-2015_1462

CVE-2012-6662

GHSA-QQXP-XP9V-VVX6

RHSA-2015:0442

RHSA-2015:1462

RHSA-2015_0442

RHSA-2015_1462

Produtos afetados

Centos

Red Hat

Jquery Ui

Referências · 27

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/jquery-ui-rails/CVE-2012-6662.yml · Exploit
• https://github.com/jquery/jquery/issues/2432 · Nota
• https://github.com/jquery/jquery · Nota
• https://github.com/jquery/jquery-ui/commit/5fee6fd5000072ff32f2d65b6451f39af9e0e39e · Correção
• https://github.com/jquery/jquery-ui/commit/f2854408cce7e4b7fc6bf8676761904af9c96bde · Correção
• http://bugs.jqueryui.com/ticket/8859 · Aviso do Fabricante
• http://rhn.redhat.com/errata/RHSA-2015-0442.html · Aviso do Fabricante
• https://twitter.com/ArayanPk/status/1698678954604085279 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2012-6662 · Nota de Segurança
• http://bugs.jqueryui.com/ticket/8861 · Aviso do Fabricante
• http://rhn.redhat.com/errata/RHSA-2015-1462.html · Aviso do Fabricante
• http://seclists.org/oss-sec/2014/q4/616 · Nota
• https://linux.oracle.com/errata/ELSA-2015-0442.html · Aviso do Fabricante
• https://twitter.com/therceman/status/1698377252013068671 · Publicação no Twitter
• https://github.com/advisories/GHSA-qqxp-xp9v-vvx6 · Nota