medium
6.1
CWE
79
Advisory Published
CVE Published
Updated

CVE-2022-31160: jQuery UI contains potential XSS vulnerability when refreshing a checkboxradio with an HTML-like initial text label

First published: Mon Jul 18 2022(Updated: )

### Impact Initializing a checkboxradio widget on an input enclosed within a label makes that parent label contents considered as the input label. If you call `.checkboxradio( "refresh" )` on such a widget and the initial HTML contained encoded HTML entities, they will erroneously get decoded. This can lead to potentially executing JavaScript code. For example, starting with the following initial secure HTML: ```html <label> <input id="test-input"> &lt;img src=x onerror="alert(1)"&gt; </label> ``` and calling: ```js $( "#test-input" ).checkboxradio(); $( "#test-input" ).checkboxradio( "refresh" ); ``` will turn the initial HTML into: ```html <label> <!-- some jQuery UI elements --> <input id="test-input"> <img src=x onerror="alert(1)"> </label> ``` and the alert will get executed. ### Patches The bug has been patched in jQuery UI 1.13.2. ### Workarounds To remediate the issue, if you can change the initial HTML, you can wrap all the non-input contents of the `label` in a `span`: ```html <label> <input id="test-input"> <span>&lt;img src=x onerror="alert(1)"&gt;</span> </label> ``` ### References https://blog.jqueryui.com/2022/07/jquery-ui-1-13-2-released/ ### For more information If you have any questions or comments about this advisory, search for a relevant issue in [the jQuery UI repo](https://github.com/jquery/jquery-ui/issues?q=is%3Aissue+is%3Aopen+sort%3Aupdated-desc). If you don't find an answer, open a new issue.

Credit: security-advisories@github.com security-advisories@github.com

Affected SoftwareAffected VersionHow to fix
debian/jqueryui
1.12.1+dfsg-8+deb11u2
1.13.2+dfsg-1
Jqueryui Jquery Ui Jquery<1.13.2
Netapp H300s Firmware
Netapp H300s
Netapp H500s Firmware
Netapp H500s
Netapp H700s Firmware
Netapp H700s
Netapp H410s Firmware
Netapp H410s
Netapp H410c Firmware
Netapp H410c
NetApp OnCommand Insight
Drupal Jquery Ui Checkboxradio Drupal=8.x-1.0
Drupal Jquery Ui Checkboxradio Drupal=8.x-1.1
Drupal Jquery Ui Checkboxradio Drupal=8.x-1.2
Drupal Jquery Ui Checkboxradio Drupal=8.x-1.3
Fedoraproject Fedora=35
Fedoraproject Fedora=36
Fedoraproject Fedora=37
Debian Debian Linux=10.0
All of
Netapp H300s Firmware
Netapp H300s
All of
Netapp H500s Firmware
Netapp H500s
All of
Netapp H700s Firmware
Netapp H700s
All of
Netapp H410s Firmware
Netapp H410s
All of
Netapp H410c Firmware
Netapp H410c
IBM Cognos Command Center<=10.2.4.1
rubygems/jquery-ui-rails<=7.0.0
nuget/jQuery.UI.Combined<1.13.2
1.13.2
maven/org.webjars.npm:jquery-ui<1.13.2
1.13.2
npm/jquery-ui<1.13.2
1.13.2

Remedy

https://github.com/jquery/jquery-ui/commit/8cc5bae1caa1fcf96bf5862c5646c787020ba3f9

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

Reference Links

Parent vulnerabilities

(Appears in the following advisories)

Frequently Asked Questions

  • What is the vulnerability ID of this issue?

    The vulnerability ID of this issue is CVE-2022-31160.

  • What is the impact of this vulnerability?

    Initializing a checkboxradio widget on an input enclosed within a label makes that parent label contents considered as the input label, leading to the incorrect decoding of encoded HTML entities.

  • How can I trigger this vulnerability?

    To trigger this vulnerability, you need to initialize a checkboxradio widget on an input enclosed within a label that contains encoded HTML entities and then call `.checkboxradio( "refresh" )` on the widget.

  • What is the severity rating of CVE-2022-31160?

    CVE-2022-31160 has a severity rating of 6.1 (Medium).

  • How do I fix CVE-2022-31160?

    To fix CVE-2022-31160, update your jQuery UI library to version 1.13.2 or higher.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2024 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203