CVE-2012-6662

Description

Cross-site scripting (XSS) vulnerability in the default content option in jquery.ui.tooltip.js in the Tooltip widget in jQuery UI before 1.10.0 allows remote attackers to inject arbitrary web script or HTML via the title attribute, which is not properly handled in the autocomplete combo box demo.

Risk Information

Base Score

8.6

MODERATE

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N/E:U/RL:O/RC:C

EPSS Score

Exploitation Probability

7.046

Associated Vulnerability

Vulnerability	OS Platform
Vulnerabilities CVE-2010-5312,CVE-2012-6662 are fixed in WebJars - jquery-ui 1.10.0	Windows
Vulnerabilities CVE-2010-5312,CVE-2012-6662 are fixed in Ruby-jquery-ui-rails 4.0.0	Windows
Vulnerabilities CVE-2012-6662 are fixed in Nuget - jQuery.UI.Combined 1.10.0	Windows
Vulnerabilities CVE-2010-5312,CVE-2012-6662 are fixed in WebJars - jquery-ui for Linux 1.10.0	Linux
Vulnerabilities CVE-2010-5312,CVE-2012-6662 are fixed in Ruby-jquery-ui-rails for Linux 4.0.0	Linux
Vulnerabilities CVE-2012-6662 are fixed in Nuget - jQuery.UI.Combined for Linux 1.10.0	Linux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234