GHSA-hpcf-8vf9-q4gj

Source

https://github.com/advisories/GHSA-hpcf-8vf9-q4gj

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2017/10/GHSA-hpcf-8vf9-q4gj/GHSA-hpcf-8vf9-q4gj.json

Aliases

CVE-2016-7103

Published

2017-10-24T18:33:35Z

Modified

2024-03-11T05:20:56.476279Z

Details

Affected versions of jquery-ui are vulnerable to a cross-site scripting vulnerability when arbitrary user input is supplied as the value of the closeText parameter in the dialog function.

jQuery-UI is a library for manipulating UI elements via jQuery.

Version 1.11.4 has a cross site scripting (XSS) vulnerability in the closeText parameter of the dialog function. If your application passes user input to this parameter, it may be vulnerable to XSS via this attack vector.

Recommendation

Upgrade to jQuery-UI 1.12.0 or later.

References

Affected packages

npm / jquery-ui

Package

Name: jquery-ui

Affected ranges

Type: SEMVER
Events: Introduced

0The exact introduced commit is unknown

Fixed

1.12.0

RubyGems / jquery-ui-rails

Package

Name: jquery-ui-rails

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0The exact introduced commit is unknown

Fixed

6.0.0

Affected versions

0.*

0.0.1

0.0.2

0.1.0

0.2.0

0.2.1

0.2.2

0.3.0

0.4.0

0.4.1

0.5.0

1.*

1.0.0

1.1.0

1.1.1

2.*

2.0.0

2.0.1

2.0.2

3.*

3.0.0

3.0.1

4.*

4.0.0

4.0.1

4.0.2

4.0.3

4.0.4

4.0.5

4.1.0

4.1.1

4.1.2

4.2.0

4.2.1

5.*

5.0.0

5.0.1

5.0.2

5.0.3

5.0.4

5.0.5

Maven / org.webjars.npm:jquery-ui

Package

Name: org.webjars.npm:jquery-ui

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0The exact introduced commit is unknown

Fixed

1.12.0

Affected versions

1.*

1.10.4

1.10.5

1.12.0-rc.2

NuGet / jQuery.UI.Combined

Package

Name: jQuery.UI.Combined

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0The exact introduced commit is unknown

Fixed

1.12.0

Affected versions

1.*

1.8.9

1.8.10

1.8.11

1.8.12

1.8.13

1.8.14

1.8.15

1.8.16

1.8.17

1.8.18

1.8.19

1.8.20

1.8.20.1

1.8.21

1.8.22

1.8.23

1.8.24

1.9.0-RC1

1.9.0

1.9.1

1.9.2

1.10.0

1.10.1

1.10.2

1.10.3

1.10.4

1.11.0

1.11.1

1.11.2

1.11.3

1.11.4