Is CVE-2012-6708 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2012-6708 being exploited in the wild.

How severe is CVE-2012-6708?

Low severity, with a CVSS score of 3, published 1 September 2020.

Which products and versions are affected?

org.webjars.npm:jquery (Maven) ECOSYSTEM:introduced=0,fixed=1.9.0; jquery-rails (RubyGems) ECOSYSTEM:introduced=0,fixed=2.2.0.

Is there a fix for CVE-2012-6708?

Yes. org.webjars.npm:jquery (Maven): upgrade to 1.9.0 or later; jquery-rails (RubyGems): upgrade to 2.2.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2012-6708 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2012-6708?

Check whether you run org.webjars.npm:jquery (Maven) or jquery-rails (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2012-6708: jQuery Cross-Site Scripting in main jQuery function

CVE-2012-6708 · Severity: low · CVSS 3 · Published 2020-09-01

jQuery, a widely used JavaScript library for website interactivity, contains a flaw in how it processes web page elements. An attacker could use this to run unauthorized scripts in a user's browser, potentially leading to the theft of session cookies or sensitive information. This issue affects older versions of the library and can be resolved by updating to a modern version.

Technologies: org.webjars.npm:jquery (Maven), jquery-rails (RubyGems). Vendors: Maven, RubyGems.

Quick answers

Is CVE-2012-6708 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2012-6708 being exploited in the wild.
How severe is CVE-2012-6708?: Low severity, with a CVSS score of 3, published 1 September 2020.
Which products and versions are affected?: org.webjars.npm:jquery (Maven) ECOSYSTEM:introduced=0,fixed=1.9.0; jquery-rails (RubyGems) ECOSYSTEM:introduced=0,fixed=2.2.0.
Is there a fix for CVE-2012-6708?: Yes. org.webjars.npm:jquery (Maven): upgrade to 1.9.0 or later; jquery-rails (RubyGems): upgrade to 2.2.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2012-6708 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2012-6708?: Check whether you run org.webjars.npm:jquery (Maven) or jquery-rails (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

org.webjars.npm:jquery (Maven): upgrade to 1.9.0 or later

# set org.webjars.npm:jquery to 1.9.0 in your pom.xml or build.gradle

jquery-rails (RubyGems): upgrade to 2.2.0 or later
```
bundle update jquery-rails
```

Technical details

A cross-site scripting (XSS) vulnerability exists in jQuery versions prior to 1.9.0. The root cause is an unanchored regular expression in the main jQuery(strInput) function used to differentiate between HTML strings and DOM selectors. In affected versions, the library identifies input as HTML if the '<' character appears anywhere in the string, whereas fixed versions require the string to explicitly start with '<'. An attacker can exploit this by providing a specially crafted string that jQuery misinterprets as executable HTML rather than a selector, leading to client-side code execution. This vulnerability is also tracked as a duplicate under CVE-2017-16011.

Affected products

jQuery jquery < 1.9.0
Rails jquery-rails < 2.2.0

Identifiers

CVE-2012-6708
GHSA-2pqj-h3vj-pqgw

Timeline

2012-06-19: disclosed: Vulnerability originally disclosed
2013-01-15: patched: Fixed in jQuery version 1.9.0
2018-01-18: advisory: NVD published CVE-2012-6708
2020-09-01: advisory: GitHub Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.