#VU65834 Cross-site scripting in jQuery UI - CVE-2022-31160

Description

The vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data when initializing a checkboxradio widget on an input enclosed within a label makes that parent label contents considered as the input label. If .checkboxradio( "refresh" ) is called on such a widget and the initial HTML contains encoded HTML entities, they will erroneously get decoded and executed. A remote attacker can execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Remediation

External links

• https://github.com/jquery/jquery-ui/security/advisories/GHSA-h6gj-6jjq-h8g9
• https://github.com/jquery/jquery-ui/commit/8cc5bae1caa1fcf96bf5862c5646c787020ba3f9
• https://blog.jqueryui.com/2022/07/jquery-ui-1-13-2-released/