What is the CVSS score of CVE-2022-31160?

CVE-2022-31160 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 1.9%.

Is there a public PoC exploit available for CVE-2022-31160?

Yes, a public proof-of-concept exploit is available for CVE-2022-31160. Prioritise patching immediately. EPSS: 1.9%.

Is there a patch available for CVE-2022-31160?

Yes, a patch is available for CVE-2022-31160. Update the affected software to the latest version immediately.

Jquery Ui CVE-2022-31160

MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2022-07-20 security-advisories@github.com

XSS Jquery Ui H300s Firmware H500s Firmware H700s Firmware H410s Firmware H410c Firmware Oncommand Insight Jquery Ui Checkboxradio Fedora Debian Linux

6.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

CVE Published

Jul 20, 2022 - 20:15 nvd

MEDIUM 6.1

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

1 maven packages depend on org.webjars.npm:jquery-ui (1 direct, 0 indirect)
28 npm packages depend on jquery-ui (17 direct, 11 indirect)

Ecosystem-wide dependent count for version 1.13.2 and other introduced versions.

DescriptionNVD

jQuery UI is a curated set of user interface interactions, effects, widgets, and themes built on top of jQuery. Versions prior to 1.13.2 are potentially vulnerable to cross-site scripting. Initializing a checkboxradio widget on an input enclosed within a label makes that parent label contents considered as the input label. Calling .checkboxradio( "refresh" ) on such a widget and the initial HTML contained encoded HTML entities will make them erroneously get decoded. This can lead to potentially executing JavaScript code. The bug has been patched in jQuery UI 1.13.2. To remediate the issue, someone who can change the initial HTML can wrap all the non-input contents of the label in a span.

AnalysisAI

jQuery UI is a curated set of user interface interactions, effects, widgets, and themes built on top of jQuery. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.

Technical ContextAI

This vulnerability is classified as Cross-Site Scripting (XSS) (CWE-79), which allows attackers to inject malicious scripts into web pages viewed by other users. jQuery UI is a curated set of user interface interactions, effects, widgets, and themes built on top of jQuery. Versions prior to 1.13.2 are potentially vulnerable to cross-site scripting. Initializing a checkboxradio widget on an input enclosed within a label makes that parent label contents considered as the input label. Calling .checkboxradio( "refresh" ) on such a widget and the initial HTML contained encoded HTML entities will make them erroneously get decoded. This can lead to potentially executing JavaScript code. The bug has been patched in jQuery UI 1.13.2. To remediate the issue, someone who can change the initial HTML can wrap all the non-input contents of the label in a span. Affected products include: Jqueryui Jquery Ui, Netapp H300S Firmware, Netapp H500S Firmware, Netapp H700S Firmware, Netapp H410S Firmware. Version information: prior to 1.13.2.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Sanitize all user input, use Content-Security-Policy headers, encode output contextually (HTML, JS, URL). Use frameworks with built-in XSS protection.