CVE-2012-6708 in jQuery and Canonical Products
Published on January 18, 2018
jQuery before 1.9.0 is vulnerable to Cross-site Scripting (XSS) attacks. The jQuery(strInput) function does not differentiate selectors from HTML in a reliable fashion. In vulnerable versions, jQuery determined whether the input was HTML by looking for the '<' character anywhere in the string, giving attackers more flexibility when attempting to construct a malicious payload. In fixed versions, jQuery only deems the input to be HTML if it explicitly starts with the '<' character, limiting exploitability only to attackers who can control the beginning of a string, which is far less common.
Products Associated with CVE-2012-6708
stack.watch emails you whenever new vulnerabilities are published in jQuery or Canonical Ubuntu Linux. Just hit a watch button to start following.
Exploit Probability
EPSS
0.90%
Percentile
75.47%
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.