Cross-site scripting in jQuery - CVE-2012-6708

Vulnerability identifier: #VU18263

CSH Severity: Medium

CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]

CVE-ID: CVE-2012-6708

CWE-ID: CWE-79

Exploitation vector: Remote access

Exploit availability: Public exploit is available

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data within the  jQuery(strInput) function that does not differentiate selectors from HTML. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

jQuery
Arch Linux
Amazon Linux AMI
Ubuntu
Opensuse
IBM Watson Machine Learning Accelerator
Tivoli Network Manager IP Edition
MobileFirst Platform
ruby (Alpine package)
jquery (Ubuntu package)
Juniper Secure Analytics (JSA)
WebSphere eXtreme Scale
QRadar User Behavior Analytics
IBM Maximo Asset Management
IBM Storage Scale System
IBM Qradar SIEM
IBM CICS TX Standard
IBM CICS TX Advanced
IBM InfoSphere Information Server

Install updates from vendor's website.

jQuery - update to 1.9.0
IBM Watson Machine Learning Accelerator - update to 2.6.0
ruby (Alpine package) - update to 2.5.7-r0
Tivoli Network Manager IP Edition - update to 4.2.0.20
Juniper Secure Analytics (JSA) - update to 7.5.0 UP8 IF03
WebSphere eXtreme Scale - update to 8.6.1.5 PH53340
jquery (Ubuntu package) - addressed in versions 1.7.2+dfsg-2ubuntu1+esm1, 1.11.3+dfsg-4ubuntu0.1~esm1, 3.2.1-1ubuntu0.1~esm1
QRadar User Behavior Analytics - update to 4.1.9
IBM Storage Scale System - addressed in versions 5.2.0.0, 6.1.9.2
IBM Qradar SIEM - update to 7.5.0 Update Pack 8 IF01
IBM Maximo Asset Management - update to 7.6.1.2.37
MobileFirst Platform - update to 8.0.0.0-MFPF-IF202304111626
IBM CICS TX Standard - update to 11.1.0.0 ifix5
IBM CICS TX Advanced - update to 11.1.0.0 ifix5
IBM InfoSphere Information Server - update to 11.7.1.4 Service pack 1

• Exploit #5594 - Linksys EA7500 2.0.8.194281 - Cross-Site Scripting (June 17, 2021)

• http://www.securityfocus.com/bid/102792
• https://bugs.jquery.com/ticket/11290
• https://github.com/jquery/jquery/commit/05531fc4080ae24070930d15ae0cea7ae056457d
• https://help.ecostruxureit.com/display/public/UADCE725/Security+fixes+in+StruxureWare+Data+Center+Expert+v7.6.0
• https://snyk.io/vuln/npm:jquery:20120206

• XSS in jQuery
• Arch Linux update for ruby-rdoc
• OpenSUSE update for ruby
• Cross-site scripting in ruby (Alpine package)
• Amazon Linux AMI update for ruby24
• Multiple vulnerabilities in IBM CICS TX Advanced
• Multiple vulnerabilities in IBM CICS TX Standard
• Multiple vulnerabilities in IBM WebSphere eXtreme Scale Liberty Deployment
• Multiple vulnerabilities in IBM InfoSphere Information Server
• Multiple vulnerabilities in IBM Maximo Asset Management
• Watson Machine Learning Accelerator on Cloud Pak for Data update for jQuery
• Multiple vulnerabilities in IBM QRadar SIEM
• Multiple vulnerabilities in IBM Storage Scale
• Multiple vulnerabilities in IBM MobileFirst Platform Foundation
• Multiple vulnerabilities in Juniper Secure Analytics (JSA)
• Multiple vulnerabilities in IBM Tivoli Network Manager IP Edition (ITNM)
• Multiple vulnerabilities in IBM QRadar User Behavior Analytics
• Ubuntu update for jquery