CVE-2016-7103: XSS
Affected versions of jquery-ui are vulnerable to a cross-site scripting vulnerability when arbitrary user input is supplied as the value of the closeText parameter in the dialog function.
jQuery-UI is a library for manipulating UI elements via jQuery.
Version 1.11.4 has a cross site scripting (XSS) vulnerability in the closeText parameter of the dialog function. If your application passes user input to this parameter, it may be vulnerable to XSS via this attack vector.
Recommendation
Upgrade to jQuery-UI 1.12.0 or later.
Other sources
Cross-site scripting (XSS) vulnerability in jQuery UI before 1.12.0 might allow remote attackers to inject arbitrary web script or HTML via the closeText parameter of the dialog function.
jQuery UI is vulnerable to cross-site scripting, caused by improper validation of user-supplied input by the dialog function. A remote attacker could exploit this vulnerability using the 'closeText' parameter in a specially-crafted URL to execute script in a victim's Web browser within the security context of the hosting Web site, once the URL is clicked. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials.
— IBM
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2016-7103?
CVE-2016-7103 is a cross-site scripting (XSS) vulnerability in jQuery UI before version 1.12.0.
How does CVE-2016-7103 affect jQuery UI?
CVE-2016-7103 allows remote attackers to execute malicious scripts on a victim's browser if arbitrary user input is supplied as the value of the `closeText` parameter in the `dialog` function.
What is the severity of CVE-2016-7103?
CVE-2016-7103 has a severity value of 6.1 (Medium).
Which versions of jQuery UI are affected by CVE-2016-7103?
Versions of jQuery UI before 1.12.0 are vulnerable to CVE-2016-7103.
How can I fix CVE-2016-7103?
To fix CVE-2016-7103, update jQuery UI to version 1.12.0 or later.