CVE-2010-5312

Cross-site scripting (XSS) vulnerability in jquery.ui.dialog.js in the Dialog widget in jQuery UI before 1.10.0 allows remote attackers to inject arbitrary web script or HTML via the title option.

CVSS v2.0 4.3 MEDIUM

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
https://github.com/jquery/jquery-ui/commit/7e9060c109b928769a664dbcc2c17bd21231b6f3	Vendor Advisory
http://seclists.org/oss-sec/2014/q4/616	Mailing List Third Party Advisory
http://bugs.jqueryui.com/ticket/6016	Exploit Vendor Advisory
http://seclists.org/oss-sec/2014/q4/613	Mailing List Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2015-0442.html	Third Party Advisory
http://www.debian.org/security/2015/dsa-3249	Third Party Advisory
http://www.securityfocus.com/bid/71106	Third Party Advisory VDB Entry
http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html	Patch Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2015-1462.html	Third Party Advisory
http://www.securitytracker.com/id/1037035	Third Party Advisory VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/98696	Third Party Advisory VDB Entry
https://security.netapp.com/advisory/ntap-20190416-0007/
https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442@%3Cdev.drill.apache.org%3E
https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f@%3Cdev.drill.apache.org%3E
https://lists.debian.org/debian-lts-announce/2022/01/msg00014.html
https://www.drupal.org/sa-core-2022-002
https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc@%3Cissues.drill.apache.org%3E

Configurations

Configuration 1 (hide)

cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*

Configuration 2 (hide)

cpe:2.3:a:jquery:jquery_ui:*:*:*:*:*:*:*:*

Information

Published : 2014-11-24 16:59

Updated : 2022-01-19 22:15

NVD link : CVE-2010-5312

Mitre link : CVE-2010-5312

JSON object : View

Products Affected

debian

debian_linux

jquery

jquery_ui

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "https://github.com/jquery/jquery-ui/commit/7e9060c109b928769a664dbcc2c17bd21231b6f3", "name": "https://github.com/jquery/jquery-ui/commit/7e9060c109b928769a664dbcc2c17bd21231b6f3", "tags": ["Vendor Advisory"], "refsource": "CONFIRM"}, {"url": "http://seclists.org/oss-sec/2014/q4/616", "name": "[oss-security] 20141114 Re: old CVE assignments for JQuery 1.10.0", "tags": ["Mailing List", "Third Party Advisory"], "refsource": "MLIST"}, {"url": "http://bugs.jqueryui.com/ticket/6016", "name": "http://bugs.jqueryui.com/ticket/6016", "tags": ["Exploit", "Vendor Advisory"], "refsource": "CONFIRM"}, {"url": "http://seclists.org/oss-sec/2014/q4/613", "name": "[oss-security] 20141114 old CVE assignments for JQuery 1.10.0", "tags": ["Mailing List", "Third Party Advisory"], "refsource": "MLIST"}, {"url": "http://rhn.redhat.com/errata/RHSA-2015-0442.html", "name": "RHSA-2015:0442", "tags": ["Third Party Advisory"], "refsource": "REDHAT"}, {"url": "http://www.debian.org/security/2015/dsa-3249", "name": "DSA-3249", "tags": ["Third Party Advisory"], "refsource": "DEBIAN"}, {"url": "http://www.securityfocus.com/bid/71106", "name": "71106", "tags": ["Third Party Advisory", "VDB Entry"], "refsource": "BID"}, {"url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html", "name": "http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html", "tags": ["Patch", "Third Party Advisory"], "refsource": "CONFIRM"}, {"url": "http://rhn.redhat.com/errata/RHSA-2015-1462.html", "name": "RHSA-2015:1462", "tags": ["Third Party Advisory"], "refsource": "REDHAT"}, {"url": "http://www.securitytracker.com/id/1037035", "name": "1037035", "tags": ["Third Party Advisory", "VDB Entry"], "refsource": "SECTRACK"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/98696", "name": "jqueryui-cve20105312-xss(98696)", "tags": ["Third Party Advisory", "VDB Entry"], "refsource": "XF"}, {"url": "https://security.netapp.com/advisory/ntap-20190416-0007/", "name": "https://security.netapp.com/advisory/ntap-20190416-0007/", "tags": [], "refsource": "CONFIRM"}, {"url": "https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442@%3Cdev.drill.apache.org%3E", "name": "[drill-dev] 20191017 Dependencies used by Drill contain known vulnerabilities", "tags": [], "refsource": "MLIST"}, {"url": "https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f@%3Cdev.drill.apache.org%3E", "name": "[drill-dev] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities", "tags": [], "refsource": "MLIST"}, {"url": "https://lists.debian.org/debian-lts-announce/2022/01/msg00014.html", "name": "[debian-lts-announce] 20220119 [SECURITY] [DLA-2889-1] drupal7 security update", "tags": [], "refsource": "MLIST"}, {"url": "https://www.drupal.org/sa-core-2022-002", "name": "https://www.drupal.org/sa-core-2022-002", "tags": [], "refsource": "CONFIRM"}, {"url": "https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc@%3Cissues.drill.apache.org%3E", "name": "[drill-issues] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities", "tags": [], "refsource": "MLIST"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "Cross-site scripting (XSS) vulnerability in jquery.ui.dialog.js in the Dialog widget in jQuery UI before 1.10.0 allows remote attackers to inject arbitrary web script or HTML via the title option."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-79"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2010-5312", "ASSIGNER": "cve@mitre.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "severity": "MEDIUM", "acInsufInfo": false, "impactScore": 2.9, "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}}, "publishedDate": "2014-11-24T16:59Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}, {"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:jquery:jquery_ui:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "1.10.0"}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2022-01-19T22:15Z"}