onyx --cves cve-2022-31160
CVE-2022-31160
- score
- <0.1
- cvss
- 6.1
- epss
- 2.7%
- published
- 2022-07-20
- kev added
- —
- first seen
jQuery UI versions prior to 1.13.2 contain a cross-site scripting caused by improper handling of encoded HTML entities when initializing checkboxradio widgets within labels, letting attackers execute arbitrary JavaScript, exploit requires modifying initial HTML content.
Timeline
How this CVE moved toward exploitation. Chart: last 30 days — trend score, EPSS, community mentions per day; hover the event lane.
- Published
- Tracked by Onyx
- Public PoC
Exploit availability
Public PoC flagged by vulnx; no direct exploit link among the citations.
Weaknesses
References 9
- https://blog.jqueryui.com/2022/07/jquery-ui-1-13-2-released/
- https://github.com/jquery/jquery-ui/commit/8cc5bae1caa1fcf96bf5862c5646c787020ba3f9
- https://github.com/jquery/jquery-ui/security/advisories/GHSA-h6gj-6jjq-h8g9
- https://lists.debian.org/debian-lts-announce/2022/12/msg00015.html
- https://security.netapp.com/advisory/ntap-20220909-0007/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6XBR3G3JR5ZIOJDO4224M3INXDS2VFDD/
- https://www.drupal.org/sa-contrib-2022-052
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/J5LGNTICB5BRFAG3DHVVELS6H3CZSQMO/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QB2FJQXCNHO32VGVOC6DY6IPGVE4VDU6/