PT-2014-2424 · Jquery+2 · Jquery Ui+2

Homakov · Published 2014-11-24 · Updated 2025-06-17 · CVE-2012-6662

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions jQuery UI versions prior to 1.10.0

Description A cross-site scripting (XSS) issue exists in the default content option in jquery.ui.tooltip.js in the Tooltip widget. This allows remote attackers to inject arbitrary web script or HTML via the title attribute, which is not properly handled in the autocomplete combo box demo.

Recommendations For versions prior to 1.10.0, update to version 1.10.0 or later to resolve the issue. As a temporary workaround, consider disabling the use of the title attribute in the autocomplete combo box demo until a patch is available. Restrict access to the Tooltip widget to minimize the risk of exploitation. Avoid using the title attribute in the affected widget until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CESA-2015_0442

CESA-2015_1462

CVE-2012-6662

GHSA-QQXP-XP9V-VVX6

RHSA-2015:0442

RHSA-2015:1462

RHSA-2015_0442

RHSA-2015_1462

Affected Products

Centos

Red Hat

Jquery Ui

References · 27

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/jquery-ui-rails/CVE-2012-6662.yml · Exploit
• https://github.com/jquery/jquery-ui/commit/5fee6fd5000072ff32f2d65b6451f39af9e0e39e · Patch
• https://github.com/jquery/jquery-ui/commit/f2854408cce7e4b7fc6bf8676761904af9c96bde · Patch
• http://bugs.jqueryui.com/ticket/8859 · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2015-0442.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2012-6662 · Security Note
• http://bugs.jqueryui.com/ticket/8861 · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2015-1462.html · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2015-0442.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2012-6662 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2015-1462.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2012-6662 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2012-6662 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2012-6662 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2012-6662 · Vendor Advisory