jQuery-UI vulnerable to Cross-site Scripting in dialog closeText
Affected versions of `jquery-ui` are vulnerable to a cross-site scripting vulnerability when arbitrary user input is supplied as the value of the `closeText` parameter in the `dialog` function. jQuery-UI is a library for manipulating UI elements via jQuery. Version 1.11.4 has a cross site scripting (XSS) vulnerability in the `closeText` parameter of the `dialog` function. If your application passes user input to this parameter, it may be vulnerable to XSS via this attack vector. ## Recommendation Upgrade to jQuery-UI 1.12.0 or later.
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2016-7103US | medium6.1 | — | ||
Cross-site scripting (XSS) vulnerability in jQuery UI before 1.12.0 might allow remote attackers to inject arbitrary web script or HTML via the closeText parameter of the dialog fu… | ||||
references
External citations — patches, advisories, analysis.
- http://rhn.redhat.com/errata/RHSA-2016-2932.htmlWEB
- http://rhn.redhat.com/errata/RHSA-2016-2933.htmlWEB
- http://rhn.redhat.com/errata/RHSA-2017-0161.htmlWEB
- http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.htmlWEB
- https://github.com/jquery-ui-rails/jquery-ui-rails/commit/d504a40538fe5f7998439ad2f8fc5c4a1f843f1cWEB
- https://github.com/jquery/api.jqueryui.com/issues/281WEB
- https://github.com/jquery/jquery-uiPACKAGE
- https://github.com/jquery/jquery-ui/commit/9644e7bae9116edaf8d37c5b38cb32b892f10ff6WEB
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan