Home > Vulnerability Database > CVE-2012-6708

Mend.io Vulnerability Database

CVE-2012-6708

Good to know:

Date: January 18, 2018

jQuery before 1.9.0 is vulnerable to Cross-site Scripting (XSS) attacks. The jQuery(strInput) function does not differentiate selectors from HTML in a reliable fashion. In vulnerable versions, jQuery determined whether the input was HTML by looking for the '<' character anywhere in the string, giving attackers more flexibility when attempting to construct a malicious payload. In fixed versions, jQuery only deems the input to be HTML if it explicitly starts with the '<' character, limiting exploitability only to attackers who can control the beginning of a string, which is far less common.

Language: Java

Severity Score

6.1

Related Resources (26)

Url: https://nvd.nist.gov/vuln/detail/CVE-2012-6708

Url: https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E

Url: https://github.com/jquery/jquery

Url: https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f@%3Cdev.drill.apache.org%3E

Url: https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E

Url: https://github.com/rails/jquery-rails/blob/v2.1.4/vendor/assets/javascripts/jquery.js#L59

Url: https://github.com/jquery/jquery/commit/05531fc4080ae24070930d15ae0cea7ae056457d

Url: https://github.com/rubysec/ruby-advisory-db/blob/master/gems/jquery-rails/CVE-2012-6708.yml

Url: https://bugs.jquery.com/ticket/12531

Url: https://research.insecurelabs.org/jquery/test

Url: https://nvd.nist.gov/vuln/detail/CVE-2017-16011

Url: https://bugs.jquery.com/ticket/6429

Url: https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442@%3Cdev.drill.apache.org%3E

Url: https://github.com/rails/jquery-rails/blob/v2.2.0/vendor/assets/javascripts/jquery.js#L67

Url: http://packetstormsecurity.com/files/161972/Linksys-EA7500-2.0.8.194281-Cross-Site-Scripting.html

Url: https://web.archive.org/web/20200227132049/http://www.securityfocus.com/bid/102792

Url: https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc@%3Cissues.drill.apache.org%3E

Url: http://www.securityfocus.com/bid/102792

Url: https://help.ecostruxureit.com/display/public/UADCE725/Security+fixes+in+StruxureWare+Data+Center+Expert+v7.6.0

Url: https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E

Url: https://bugs.jquery.com/ticket/9521

Url: http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00041.html

Url: https://access.redhat.com/security/cve/CVE-2012-6708

Url: http://packetstormsecurity.com/files/153237/RetireJS-CORS-Issue-Script-Execution.html

Url: https://bugs.jquery.com/ticket/11290

Url: https://www.mend.io/vulnerability-database/CVE-2012-6708

Severity Score

6.1

Weakness Type (CWE)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CWE-79

Windows Shortcut Following (.LNK)

CWE-64

Top Fix

Upgrade Version

Upgrade to version jQuery - 1.9.0;jquery - 1.9.0;jquery-rails - 2.2.0

Learn More

CVSS v3.1

Base Score:	6.1
Attack Vector (AV):	NETWORK
Attack Complexity (AC):	LOW
Privileges Required (PR):	NONE
User Interaction (UI):	REQUIRED
Scope (S):	CHANGED
Confidentiality (C):	LOW
Integrity (I):	LOW
Availability (A):	NONE

CVSS v2

Base Score:	4.3
Access Vector (AV):	NETWORK
Access Complexity (AC):	MEDIUM
Authentication (AU):	NONE
Confidentiality (C):	NONE
Integrity (I):	PARTIAL
Availability (A):	NONE
Additional information:

Mend.io Vulnerability Database

We found results for “”

CVE-2012-6708

Good to know:

Date: January 18, 2018

Language: Java

Severity Score

Related Resources (26)

Severity Score

Weakness Type (CWE)

Top Fix

Upgrade Version

CVSS v3.1

CVSS v2

Do you need more information?