CVE-2012-6662: jqueryui jquery_ui

Modified

AliasesUBUNTU-CVE-2012-6662DEBIAN-CVE-2012-6662GHSA-qqxp-xp9v-vvx6

Published 24-11-2014Last modified 06-08-2024

Vulnerability summary

CVE-2012-6662 is a medium (CVSS 4.3) vulnerability in jqueryui jquery_ui. EPSS estimates a 7.47% chance of exploitation in the next 30 days, higher than 94.4% of scored vulnerabilities.

Priority

Routine

Not severe (CVSS 4.3, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

4.3/10

010

Medium · v2.0 (NVD)

EPSS score

7.47%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 2

RHSA-2015:0442 RHSA-2015:1462

Timeline

24-11-2014
PublishedVulnerability first disclosed.
06-08-2024
Last modifiedVulnerability information updated.

Description

Cross-site scripting (XSS) vulnerability in the default content option in jquery.ui.tooltip.js in the Tooltip widget in jQuery UI before 1.10.0 allows remote attackers to inject arbitrary web script or HTML via the title attribute, which is not properly handled in the autocomplete combo box demo.

CVSS metrics

1 score · 1 source · 1 version

v2.04.3

EPSS trend

Probability

7.47%

Chance of exploitation in the next 30 days

Percentile

94%

Versus all other CVEs

30-day change

No change 0.00 pp

From 7.47% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-79Improper Neutralization of Input During Web Page GenerationThe product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Affected systems

Version check

Known conditions: network-reachable, no authentication (CVSS vector). Other conditions: not stated in public data.

Redhat4 products

Debian1 product

jqueryui< 1.10.1+dfsg-1

Jqueryui1 product

jquery_ui1.10.0:rc1

Npm1 product

jquery-ui< 1.10.0

NuGet1 product

jQuery.UI.Combined< 1.10.0

Org.webjars.npm1 product

jquery-ui< 1.10.0

RubyGems1 product

jquery-ui-rails< 4.0.0

Ubuntu1 product

jqueryui< 1.10.1+dfsg-1

8 vendors · 11 products

References

17 links

github.com/jquery/jquery/issues/2432X Refsource MISCWEB
rhn.redhat.com/errata/RHSA-2015-0442.htmlVendor AdvisoryX Refsource REDHATThird Party AdvisoryWEB
bugs.jqueryui.com/ticket/8861X Refsource CONFIRMIssue TrackingVendor AdvisoryWEB
exchange.xforce.ibmcloud.com/vulnerabilities/98697VDB EntryX Refsource XFWEB
seclists.org/oss-sec/2014/q4/616Mailing ListX Refsource MLISTThird Party AdvisoryVDB EntryWEB
github.com/jquery/jquery-ui/commit/f2854408cce7e4b7fc6bf8676761904af9c96bdeX Refsource CONFIRMIssue TrackingPatchThird Party AdvisoryWEB
rhn.redhat.com/errata/RHSA-2015-1462.htmlVendor AdvisoryX Refsource REDHATWEB
bugs.jqueryui.com/ticket/8859X Refsource CONFIRMIssue TrackingVendor AdvisoryWEB
www.securityfocus.com/bid/71107VDB EntryX Refsource BID
seclists.org/oss-sec/2014/q4/613Mailing ListX Refsource MLISTThird Party AdvisoryVDB EntryWEB

Show all 17 references

github.com/jquery/jquery-ui/commit/5fee6fd5000072ff32f2d65b6451f39af9e0e39eX Refsource CONFIRMIssue TrackingPatchThird Party AdvisoryWEB
ubuntu.com/security/CVE-2012-6662REPORT
www.cve.org/CVERecord?id=CVE-2012-6662REPORT
security-tracker.debian.org/tracker/CVE-2012-6662Advisory
nvd.nist.gov/vuln/detail/CVE-2012-6662Advisory
github.com/jquery/jqueryPACKAGE
github.com/rubysec/ruby-advisory-db/blob/master/gems/jquery-ui-rails/CVE-2012-6662.ymlWEB