XSS in Jqueryui Jquery Ui
CVE-2016-7103
Cross-site scripting (XSS) vulnerability in jQuery UI before 1.12.0 might allow remote attackers to inject arbitrary web script or HTML via the closeText parameter of the dialog function.
Vulnerability class: XSS (Cross-Site Scripting)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 6.1 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N.
EPSS exploit prediction
EPSS: 0.292 (98.2th percentile), scored .
Moderate probability of exploitation in the next 30 days — watch for active exploitation reports. 98th percentile — 98.2% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.226 · newest: 0.292 · change: +0.066
Affected products
- Jqueryui Jquery Ui
- Juniper Junos — versions 21.2
- NetApp Snapcenter
- Oracle Application Express
- Oracle Business Intelligence — versions 12.2.1.3.0, 12.2.1.4.0
- Oracle Hospitality Cruise Fleet Management — versions 9.0.11
- Oracle Oss Support Tools — versions 2.12.42
- Oracle Primavera Unifier
- Oracle Siebel Ui Framework
- Oracle Weblogic Server — versions 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- rhn.redhat.com/errata/RHSA-2017-0161.html (vendor-advisory, VDB Entry, Third Party Advisory)
- rhn.redhat.com/errata/RHSA-2016-2933.html (vendor-advisory, Third Party Advisory)
- rhn.redhat.com/errata/RHSA-2016-2932.html (vendor-advisory, Third Party Advisory)
- www.securityfocus.com/bid/104823 (VDB Entry, Third Party Advisory, vdb-entry, Broken Link)
- lists.apache.org/thread.html/ff8dcfe29377088ab655fda9d585dccd5b1f07fabd94ae84fd… (mailing-list, Mailing List, Third Party Advisory)
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/… (vendor-advisory, Mailing List, Third Party Advisory)
- lists.apache.org/thread.html/ba79cf1658741e9f146e4c59b50aee56656ea95d841d358d00… (mailing-list, Mailing List, Third Party Advisory)
- lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b… (mailing-list, Mailing List, Third Party Advisory)
- lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864… (mailing-list, Mailing List, Third Party Advisory)
- lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d79… (mailing-list, Mailing List, Third Party Advisory)
Frequently asked questions
- What is CVE-2016-7103?
- CVE-2016-7103 is a medium-severity vulnerability in Jqueryui Jquery Ui, classified under Cross-site Scripting. CVSS score: 6.1/10. Published 2017-03-15.
- How severe is CVE-2016-7103?
- Medium severity. CVSS v3 base score is 6.1 out of 10.
- Is CVE-2016-7103 known to be exploited?
- 6 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.