NetSight
IP …
medium6.1

CVE-2016-7103

jQuery-UI vulnerable to Cross-site Scripting in dialog closeText

Impact

Affected versions of `jquery-ui` are vulnerable to a cross-site scripting vulnerability when arbitrary user input is supplied as the value of the `closeText` parameter in the `dialog` function. jQuery-UI is a library for manipulating UI elements via jQuery. Version 1.11.4 has a cross site scripting (XSS) vulnerability in the `closeText` parameter of the `dialog` function. If your application passes user input to this parameter, it may be vulnerable to XSS via this attack vector. ## Recommendation Upgrade to jQuery-UI 1.12.0 or later.

Affected packages

EcosystemPackageAffectedFixed in
npmjquery-ui< 1.12.01.12.0
rubygemsjquery-ui-rails< 6.0.06.0.0
mavenorg.webjars.npm:jquery-ui< 1.12.01.12.0
nugetjQuery.UI.Combined< 1.12.01.12.0

Affected products

VendorProductAffected versions
JqueryuiJquery Ui
from 1.10.0 through 1.11.4
OracleApplication Express
before 19.1
OracleBusiness Intelligence
Versions 12.2.1.3.0, 12.2.1.4.0
OracleHospitality Cruise Fleet Management
Version 9.0.11
OracleOss Support Tools
before 2.12.42
Version 2.12.42
OraclePrimavera Unifier
from 16.0 through 16.2
from 17.0 through 17.12.4
from 18.0 through 18.8.4
OracleSiebel Ui Framework
through 21.2
OracleWeblogic Server
Versions 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0
FedoraprojectFedora
Versions 30, 35, 36
NetappSnapcenter
All versions
RedhatOpenstack
Versions 7.0, 8, 9
JuniperJunos
Version 21.2

Weakness classification

CWE-79

References