CVE-2022-31160

Name: CVE-2022-31160
Creator: NVD / NIST
Published: 2022-07-20T20:15:08.053+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

MEDIUMCVSS 6.1/10EPSS 1.93%

Last modified Jun 17, 2026

CVE-2022-31160 is a medium-severity vulnerability rated 6.1/10 on the CVSS scale. jQuery UI is a curated set of user interface interactions, effects, widgets, and themes built on top of jQuery. Versions prior to 1.13.2 are potentially vulnerable to cross-site scripting. EPSS estimates a 1.93% chance of exploitation in the next 30 days.

Description

jQuery UI is a curated set of user interface interactions, effects, widgets, and themes built on top of jQuery. Versions prior to 1.13.2 are potentially vulnerable to cross-site scripting. Initializing a checkboxradio widget on an input enclosed within a label makes that parent label contents considered as the input label. Calling `.checkboxradio( "refresh" )` on such a widget and the initial HTML contained encoded HTML entities will make them erroneously get decoded. This can lead to potentially executing JavaScript code. The bug has been patched in jQuery UI 1.13.2. To remediate the issue, someone who can change the initial HTML can wrap all the non-input contents of the `label` in a `span`.

Metrics

CVSS 3.1

6.1/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS Probability

1.93%

77.5th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-79

Affected Software

Vendor	Product	Versions
Jqueryui	Jquery Ui	< 1.13.2
Netapp	H300s Firmware	All versions
Netapp	H500s Firmware	All versions
Netapp	H700s Firmware	All versions
Netapp	H410s Firmware	All versions
Netapp	H410c Firmware	All versions
Netapp	Oncommand Insight	All versions
Drupal	Jquery Ui Checkboxradio	8.x-1.0
Drupal	Jquery Ui Checkboxradio	8.x-1.1
Drupal	Jquery Ui Checkboxradio	8.x-1.2
Drupal	Jquery Ui Checkboxradio	8.x-1.3
Fedoraproject	Fedora	35
Fedoraproject	Fedora	36
Fedoraproject	Fedora	37
Debian	Debian Linux	10.0

References

https://blog.jqueryui.com/2022/07/jquery-ui-1-13-2-released/Release Notes, Vendor Advisory
https://github.com/jquery/jquery-ui/commit/8cc5bae1caa1fcf96bf5862c5646c787020ba3f9Patch, Third Party Advisory
https://github.com/jquery/jquery-ui/security/advisories/GHSA-h6gj-6jjq-h8g9Exploit, Mitigation, Release Notes, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/12/msg00015.htmlMailing List, Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6XBR3G3JR5ZIOJDO4224M3INXDS2VFDD/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/J5LGNTICB5BRFAG3DHVVELS6H3CZSQMO/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QB2FJQXCNHO32VGVOC6DY6IPGVE4VDU6/
https://security.netapp.com/advisory/ntap-20220909-0007/Third Party Advisory
https://www.drupal.org/sa-contrib-2022-052Third Party Advisory
https://blog.jqueryui.com/2022/07/jquery-ui-1-13-2-released/Release Notes, Vendor Advisory
https://github.com/jquery/jquery-ui/commit/8cc5bae1caa1fcf96bf5862c5646c787020ba3f9Patch, Third Party Advisory
https://github.com/jquery/jquery-ui/security/advisories/GHSA-h6gj-6jjq-h8g9Exploit, Mitigation, Release Notes, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/12/msg00015.htmlMailing List, Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6XBR3G3JR5ZIOJDO4224M3INXDS2VFDD/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/J5LGNTICB5BRFAG3DHVVELS6H3CZSQMO/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QB2FJQXCNHO32VGVOC6DY6IPGVE4VDU6/
https://security.netapp.com/advisory/ntap-20220909-0007/Third Party Advisory
https://www.drupal.org/sa-contrib-2022-052Third Party Advisory

Timeline

Published: Jul 20, 2022
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2022-31160?

How severe is CVE-2022-31160?

CVE-2022-31160 has a CVSS score of 6.1/10 (MEDIUM severity). The EPSS model estimates a 1.93% probability of exploitation in the next 30 days.

How do I fix CVE-2022-31160?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2022-31160?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST