Medium severity · published Mar 15, 2017
CVE-2016-7103
Cross-site scripting (XSS) vulnerability in jQuery UI before 1.12.0 might allow remote attackers to inject arbitrary web script or HTML via the closeText parameter of the dialog…
6.1
CVSS
29.2%
EPSS
No
On KEV
Description
Cross-site scripting (XSS) vulnerability in jQuery UI before 1.12.0 might allow remote attackers to inject arbitrary web script or HTML via the closeText parameter of the dialog function.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)29.2% · higher than 98% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
JO
Junos OS · Juniper
21.2 · source: NVD
WS
WebLogic Server · Oracle
10.3.6.0.0; 12.1.3.0.0; 12.2.1.3.0 · source: NVD
AE
Application Express · Oracle
before 19.1 · source: NVD
BI
Business Intelligence · Oracle
12.2.1.3.0; 12.2.1.4.0 · source: NVD
DL
Debian Linux · Debian
9.0 · source: NVD
FE
Fedora · Fedoraproject
30; 35; 36 · source: NVD
HC
Hospitality Cruise Fleet Management · Oracle
9.0.11 · source: NVD
JU
Jquery UI · Jqueryui
1.10.0 through 1.11.4 · source: NVD
OP
Openstack · Redhat
7.0; 8; 9 · source: NVD
OS
Oss Support Tools · Oracle
before 2.12.42; 2.12.42 · source: NVD
PU
Primavera Unifier · Oracle
16.0 through 16.2; 17.0 through 17.12.4; 18.0 through 18.8.4 · source: NVD
SU
Siebel UI Framework · Oracle
through 21.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2016-7103
CVE.org
https://www.cve.org/CVERecord?id=CVE-2016-7103
Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2016-2932.html
Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2016-2933.html
Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2017-0161.html
Patch
http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
Broken Link
http://www.securityfocus.com/bid/104823
Exploit
https://github.com/jquery/api.jqueryui.com/issues/281
More from Junos OS
9.8
CVE-2023-36845
Junos OS: EX and SRX Series: A PHP vulnerability in J-Web allows an unauthenticated to control an important environment variable
9.8
CVE-2020-1631
Out of Cycle Security Advisory: Junos OS: Security vulnerability in J-Web and web based (HTTP/HTTPS) services
7.5
CVE-2015-5477
ISC BIND Data Processing Errors Vulnerability
5.3
CVE-2023-36851
Junos OS: SRX Series: A vulnerability in J-Web allows an unauthenticated attacker to upload and download arbitrary files
5.3
CVE-2023-36846
Junos OS: SRX Series: A vulnerability in J-Web allows an unauthenticated attacker to upload arbitrary files