Cross-site scripting (XSS) vulnerability in jQuery UI before 1.12.0 might allow remote attackers to inject arbitrary web script or HTML via the closeText parameter of the dialog function.
Vulnerabilidad de XSS en la interfaz de usuario de jQuery en versiones anteriores a 1.12.0 podría permitir a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través del parámetro closeText de la función dialog.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
| Attack Vector | NETWORK |
|---|---|
| Attack Complexity | LOW |
| Privileges Required | NONE |
| User Interaction | REQUIRED |
| Scope | CHANGED |
| Confidentiality Impact | LOW |
| Integrity Impact | LOW |
| Availability Impact | NONE |
AV:N/AC:M/Au:N/C:N/I:P/A:N
| Access Vector | NETWORK |
|---|---|
| Access Complexity | MEDIUM |
| Authentication | NONE |
| Confidentiality Impact | NONE |
| Integrity Impact | PARTIAL |
| Availability Impact | NONE |
| Source | Type | Description |
|---|---|---|
| [email protected] | Primary |
en
CWE-79
|
| Vendor | Product | Version | Update | Type |
|---|---|---|---|---|
| jqueryui | jquery_ui | * | <built-in method update of dict object at 0x72a9cd06da40> | Application |
| oracle | application_express | * | <built-in method update of dict object at 0x72a9b0906b80> | Application |
| oracle | business_intelligence | 12.2.1.3.0 | <built-in method update of dict object at 0x72a9cc562600> | Application |
| oracle | business_intelligence | 12.2.1.4.0 | <built-in method update of dict object at 0x72a9b0b69c40> | Application |
| oracle | hospitality_cruise_fleet_management | 9.0.11 | <built-in method update of dict object at 0x72a9cd06f7c0> | Application |
| oracle | oss_support_tools | * | <built-in method update of dict object at 0x72a9b0a77b40> | Application |
| oracle | oss_support_tools | 2.12.42 | <built-in method update of dict object at 0x72a9b0905ac0> | Application |
| oracle | primavera_unifier | * | <built-in method update of dict object at 0x72a9b0905480> | Application |
| oracle | primavera_unifier | * | <built-in method update of dict object at 0x72a9b0a76c40> | Application |
| oracle | primavera_unifier | * | <built-in method update of dict object at 0x72a9cd06ee00> | Application |
| oracle | siebel_ui_framework | * | <built-in method update of dict object at 0x72a9b0b6af80> | Application |
| oracle | weblogic_server | 10.3.6.0.0 | <built-in method update of dict object at 0x72a9b0905000> | Application |
| oracle | weblogic_server | 12.1.3.0.0 | <built-in method update of dict object at 0x72a9cc5ddfc0> | Application |
| oracle | weblogic_server | 12.2.1.3.0 | <built-in method update of dict object at 0x72a9cd06c080> | Application |
| fedoraproject | fedora | 30 | <built-in method update of dict object at 0x72a9b0906200> | Operating System |
| fedoraproject | fedora | 35 | <built-in method update of dict object at 0x72a9b09077c0> | Operating System |
| fedoraproject | fedora | 36 | <built-in method update of dict object at 0x72a9b0906000> | Operating System |
| netapp | snapcenter | - | <built-in method update of dict object at 0x72a9cc6994c0> | Application |
| redhat | openstack | 7.0 | <built-in method update of dict object at 0x72a9b0a75580> | Application |
| redhat | openstack | 8 | <built-in method update of dict object at 0x72a9b0b69a00> | Application |
| redhat | openstack | 9 | <built-in method update of dict object at 0x72a9b0a75c80> | Application |
| juniper | junos | 21.2 | <built-in method update of dict object at 0x72a9b09060c0> | Operating System |
| debian | debian_linux | 9.0 | <built-in method update of dict object at 0x72a9cd0d9300> | Operating System |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:jqueryui:jquery_ui:*:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:oracle:application_express:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:business_intelligence:12.2.1.3.0:*:*:*:enterprise:*:*:* |
| Yes | cpe:2.3:a:oracle:business_intelligence:12.2.1.4.0:*:*:*:enterprise:*:*:* |
| Yes | cpe:2.3:a:oracle:hospitality_cruise_fleet_management:9.0.11:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:oss_support_tools:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:oss_support_tools:2.12.42:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:primavera_unifier:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:primavera_unifier:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:primavera_unifier:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:siebel_ui_framework:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:weblogic_server:10.3.6.0.0:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:weblogic_server:12.1.3.0.0:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:weblogic_server:12.2.1.3.0:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:redhat:openstack:7.0:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:redhat:openstack:8:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:redhat:openstack:9:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:juniper:junos:21.2:-:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* |