CVE-2022-31160
Summary
| CVE | CVE-2022-31160 |
|---|
| State | PUBLIC |
|---|
| Assigner | [email protected] |
|---|
| Source Priority | CVE Program / NVD first with legacy fallback |
|---|
| Published | 2022-07-20 20:15:00 UTC |
|---|
| Updated | 2023-11-07 03:47:00 UTC |
|---|
| Description | jQuery UI is a curated set of user interface interactions, effects, widgets, and themes built on top of jQuery. Versions prior to 1.13.2 are potentially vulnerable to cross-site scripting. Initializing a checkboxradio widget on an input enclosed within a label makes that parent label contents considered as the input label. Calling `.checkboxradio( "refresh" )` on such a widget and the initial HTML contained encoded HTML entities will make them erroneously get decoded. This can lead to potentially executing JavaScript code. The bug has been patched in jQuery UI 1.13.2. To remediate the issue, someone who can change the initial HTML can wrap all the non-input contents of the `label` in a `span`. |
|---|
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|
| [SECURITY] Fedora 37 Update: js-jquery-ui-1.13.2-1.fc37 - package-announce - Fedora Mailing-Lists |
FEDORA |
lists.fedoraproject.org |
|
| [SECURITY] Fedora 35 Update: js-jquery-ui-1.13.2-1.fc35 - package-announce - Fedora Mailing-Lists |
|
lists.fedoraproject.org |
|
| [SECURITY] [DLA 3230-1] jqueryui security update |
MLIST |
lists.debian.org |
|
| Checkboxradio: Don't re-evaluate text labels as HTML · jquery/jquery-ui@8cc5bae · GitHub |
MISC |
github.com |
|
| XSS when refreshing a checkboxradio with an HTML-like initial text label · Advisory · jquery/jquery-ui · GitHub |
CONFIRM |
github.com |
|
| CVE-2022-31160 jQuery Vulnerability in NetApp Products | NetApp Product Security |
CONFIRM |
security.netapp.com |
|
| [SECURITY] Fedora 36 Update: js-jquery-ui-1.13.2-1.fc36 - package-announce - Fedora Mailing-Lists |
|
lists.fedoraproject.org |
|
| [SECURITY] Fedora 36 Update: js-jquery-ui-1.13.2-1.fc36 - package-announce - Fedora Mailing-Lists |
FEDORA |
lists.fedoraproject.org |
|
| Access to this page has been denied. |
MISC |
www.drupal.org |
|
| jQuery UI 1.13.2 released | jQuery UI Blog |
MISC |
blog.jqueryui.com |
|
| [SECURITY] Fedora 37 Update: js-jquery-ui-1.13.2-1.fc37 - package-announce - Fedora Mailing-Lists |
|
lists.fedoraproject.org |
|
| [SECURITY] Fedora 35 Update: js-jquery-ui-1.13.2-1.fc35 - package-announce - Fedora Mailing-Lists |
FEDORA |
lists.fedoraproject.org |
|
| CVE Program record |
CVE.ORG |
www.cve.org |
canonical |
| NVD vulnerability detail |
NVD |
nvd.nist.gov |
canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 150676 Oracle WebLogic Server Multiple Vulnerabilities (APR-2023)
- 181307 Debian Security Update for jqueryui (DLA 3230-1)
- 183658 Debian Security Update for jqueryui (CVE-2022-31160)
- 199813 Ubuntu Security Notification for jQuery UI Vulnerabilities (USN-6419-1)
- 283327 Fedora Security Update for js (FEDORA-2022-1a01ed37e2)
- 283328 Fedora Security Update for js (FEDORA-2022-22d8ba36d0)
- 283423 Fedora Security Update for js (FEDORA-2022-7291b78111)
- 87542 Oracle WebLogic Server Multiple Vulnerabilities (CPUAPR2023)
- 995435 DotNet (Nuget) Security Update for jQuery.UI.Combined (GHSA-h6gj-6jjq-h8g9)
- 995444 Rubygems (Rubygems) Security Update for jquery-ui-rails (GHSA-h6gj-6jjq-h8g9)
- 995462 Java (Maven) Security Update for org.webjars.npm:jquery-ui (GHSA-h6gj-6jjq-h8g9)
