CVE-2022-31160 Details
Description
jQuery UI is a curated set of user interface interactions, effects, widgets, and themes built on top of jQuery. Versions prior to 1.13.2 are potentially vulnerable to cross-site scripting. Initializing a checkboxradio widget on an input enclosed within a label makes that parent label contents considered as the input label. Calling `.checkboxradio( "refresh" )` on such a widget and the initial HTML contained encoded HTML entities will make them erroneously get decoded. This can lead to potentially executing JavaScript code. The bug has been patched in jQuery UI 1.13.2. To remediate the issue, someone who can change the initial HTML can wrap all the non-input contents of the `label` in a `span`.
A cross-site scripting vulnerability has been identified in the jQuery UI Checkboxradio widget, affecting versions prior to 1.13.2. When a checkboxradio widget is initialized on an input within a label, the label's contents are treated as the input label. If the initial HTML includes encoded entities, calling '.checkboxradio("refresh")' will decode them, potentially leading to the execution of JavaScript. This vulnerability is particularly concerning if the label content is based on user input, as it could allow for the injection and execution of malicious scripts.
Users can upgrade to jQuery UI version 1.13.2 or later, or if using the jQuery UI Checkboxradio module for Drupal 9, upgrade to version 8.x-1.4.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 22, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| jqueryui jquery ui | < 1.13.2 |
CPE
Remediation
| |
| netapp h300s firmware | All versions |
CPE
Remediation
| |
| netapp h300s | All versions |
CPE
Remediation
| |
| netapp h500s firmware | All versions |
CPE
Remediation
| |
| netapp h500s | All versions |
CPE
Remediation
| |
| netapp h700s firmware | All versions |
CPE
Remediation
| |
| netapp h700s | All versions |
CPE
Remediation
| |
| netapp h410s firmware | All versions |
CPE
Remediation
| |
| netapp h410s | All versions |
CPE
Remediation
| |
| netapp h410c firmware | All versions |
CPE
Remediation
| |
| netapp h410c | All versions |
CPE
Remediation
| |
| netapp oncommand insight | All versions |
CPE
Remediation
| |
| drupal jquery ui checkboxradio | 8.x-1.0 8.x-1.1 8.x-1.2 8.x-1.3 |
CPE
Remediation
| |
| fedoraproject fedora | 35 36 37 |
CPE
Remediation
| |
| debian debian linux | 10.0 |
CPE
Remediation
| |
Change History
12 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Nov 21, 2024 | CVE Modified | CVE |
| May 14, 2024 | CVE Modified | [email protected] |
| Nov 7, 2023 | CVE Modified | [email protected] |
| Feb 10, 2023 | Modified Analysis | [email protected] |
| Dec 7, 2022 | CVE Modified | [email protected] |
| Nov 21, 2022 | CVE Modified | [email protected] |
| Sep 29, 2022 | Modified Analysis | [email protected] |
| Sep 9, 2022 | CVE Modified | [email protected] |
| Aug 10, 2022 | CVE Modified | [email protected] |
| Jul 27, 2022 | Initial Analysis | [email protected] |