CVE-2010-5312

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 18.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2014-11-24 · updated 2026-06-16
Weakness: CWE-79

Description

Cross-site scripting (XSS) vulnerability in jquery.ui.dialog.js in the Dialog widget in jQuery UI before 1.10.0 allows remote attackers to inject arbitrary web script or HTML via the title option.

Affected products

Apache Software Foundation Apache Drill: 1.16.0
Debian Linux: 7.0, 9.0
Drupal: from 7.0 before 7.86 — fixed in 7.86
Fedoraproject Fedora: 35, 36
Jqueryui Jquery Ui: before 1.10.0 — fixed in 1.10.0
NetApp SnapCenter: all versions

How to fix

Upgrade to a fixed version: Drupal 7.86; Jqueryui Jquery Ui 1.10.0. Check the vendor advisory for mitigations.

References

http://bugs.jqueryui.com/ticket/6016
http://rhn.redhat.com/errata/RHSA-2015-0442.html
http://rhn.redhat.com/errata/RHSA-2015-1462.html
http://seclists.org/oss-sec/2014/q4/613
http://seclists.org/oss-sec/2014/q4/616
http://www.debian.org/security/2015/dsa-3249
http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
http://www.securityfocus.com/bid/71106
http://www.securitytracker.com/id/1037035
https://exchange.xforce.ibmcloud.com/vulnerabilities/98696
https://github.com/jquery/jquery-ui/commit/7e9060c109b928769a664dbcc2c17bd21231b6f3
https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E

Get alerted when CVE-2010-5312 or the next vulnerability affects your stack