GHSA-g8q2-24jh-5hpc
High severity vulnerability that affects jquery-ui
High
Withdrawn Jun 16, 2020
MavenNuGetRubyGemsnpm
- Severity
- High
- The publisher's own rating, not a CVSS score
- Exploit chance (EPSS)
- —
- No score published
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- —
- Not classified
- Fix
- Available
- 4 packages have a fixed version
Description
Withdrawn, accidental duplicate publish.
Cross-site scripting (XSS) vulnerability in jQuery UI before 1.12.0 might allow remote attackers to inject arbitrary web script or HTML via the closeText parameter of the dialog function.
Affected versions
Maven
| Package | Vulnerable | Fixed in |
|---|---|---|
| org.webjars.npm:jquery-ui | < 1.12.0 |
1.12.0 |
NuGet
| Package | Vulnerable | Fixed in |
|---|---|---|
| jQuery.UI.Combined | < 1.12.0 |
1.12.0 |
RubyGems
| Package | Vulnerable | Fixed in |
|---|---|---|
| jquery-ui-rails | < 6.0.0 |
6.0.0 |
npm
| Package | Vulnerable | Fixed in |
|---|---|---|
| jquery-ui | < 1.12.0 |
1.12.0 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
org.webjars.npm:jquery-ui Maven → 1.12.0
- maven
<dependency><groupId>org.webjars.npm</groupId><artifactId>jquery-ui</artifactId><version>1.12.0</version></dependency>- gradle
implementation("org.webjars.npm:jquery-ui:1.12.0")
jQuery.UI.Combined NuGet → 1.12.0
- dotnet
dotnet add package jQuery.UI.Combined --version 1.12.0
jquery-ui-rails RubyGems → 6.0.0
- bundler
bundle update jquery-ui-rails # Gemfile: gem "jquery-ui-rails", ">= 6.0.0"
jquery-ui npm → 1.12.0
- npm
npm install jquery-ui@1.12.0- yarn
yarn add jquery-ui@1.12.0- pnpm
pnpm add jquery-ui@1.12.0
References
Timeline
- Published
- Withdrawn
- Last updated by the source
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-h6gj-6jjq-h8g9 jQuery UI vulnerable to XSS when refreshing a checkboxradio with an HTML-like initial text label | Medium | Also affects jquery-ui |
| GHSA-j7qv-pgf6-hvh4 XSS in `*Text` options of the Datepicker widget in jquery-ui | Medium | Also affects jquery-ui |
| GHSA-gpqq-952q-5327 XSS in the `of` option of the `.position()` util in jquery-ui | Medium | Also affects jquery-ui |
| GHSA-9gj3-hwp5-pmwc XSS in the `altField` option of the Datepicker widget in jquery-ui | Medium | Also affects jquery-ui |
| GHSA-wcm2-9c89-wmfm Cross-site Scripting in jquery-ui | Medium | Also affects jquery-ui |
| GHSA-qqxp-xp9v-vvx6 jquery-ui Tooltip widget vulnerable to XSS | Medium | Also affects jquery-ui |
| GHSA-hpcf-8vf9-q4gj jQuery-UI vulnerable to Cross-site Scripting in dialog closeText | Medium | Also affects jquery-ui |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor