PT-2012-1248 · Jquery+2 · Jquery+2

Timmywil · Published 2012-02-06 · Updated 2026-02-18 · CVE-2012-6708

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions jquery versions prior to 1.9.0

Description The issue is related to the jQuery function not properly differentiating between HTML and selectors, allowing for cross-site scripting attacks. In vulnerable versions, jQuery determines whether the input is HTML by looking for the '<' character anywhere in the string, giving attackers flexibility when constructing a malicious payload. This can lead to client-side code execution. The estimated number of potentially affected devices is not specified.

Recommendations Update to version 1.9.0 or later. As a temporary workaround, consider restricting the use of the vulnerable jquery function until a patch is available. Avoid using the jquery function with untrusted input to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-64

CWE-79

Related Identifiers

AZL-40951

AZL-43897

AZL-44730

AZL-44937

BDU:2023-07702

CVE-2012-6708

GHSA-2PQJ-H3VJ-PQGW

OPENSUSE-SU-2020:0395-1

OPENSUSE-SU-2020_0395-1

SUSE-SU-2020:0737-1

USN-7622-1

Affected Products

Suse

Ubuntu

Jquery

References · 64

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/jquery-rails/CVE-2012-6708.yml · Exploit
• 🔥 https://bugs.jquery.com/ticket/11290 · Exploit
• 🔥 https://exploit-db.com/exploits/49708 · Exploit
• https://github.com/jquery/jquery/commit/05531fc4080ae24070930d15ae0cea7ae056457d · Patch
• https://ubuntu.com/security/CVE-2020-11023 · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2012-6708 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-44730 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-07702 · Security Note
• https://osv.dev/vulnerability/GHSA-2pqj-h3vj-pqgw · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2012-6708 · Security Note
• https://osv.dev/vulnerability/USN-7622-1 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00041.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2012-6708 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-11022 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-16011 · Security Note