6.1

CVE-2020-11022

Exploit

jQuery has a potential XSS vulnerability

In jQuery starting with 1.12.0 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Jquery ≫ Jquery Version >= 1.2 < 3.5.0
Drupal ≫ Drupal Version >= 7.0 < 7.70
Drupal ≫ Drupal Version >= 8.7.0 < 8.7.14
Drupal ≫ Drupal Version >= 8.8.0 < 8.8.6
Debian ≫ Debian Linux Version 9.0
Fedoraproject ≫ Fedora Version 31
Fedoraproject ≫ Fedora Version 32
Fedoraproject ≫ Fedora Version 33
Oracle ≫ Application Testing Suite Version 13.3.0.1
Oracle ≫ Blockchain Platform Version < 21.1.2
Oracle ≫ Communications Eagle Application Processor Version >= 16.1.0 <= 16.4.0
Oracle ≫ Enterprise Manager Ops Center Version 12.4.0.0
Oracle ≫ Financial Services Data Foundation Version >= 8.0.6 <= 8.1.0
Oracle ≫ Healthcare Foundation Version 7.1.1
Oracle ≫ Healthcare Foundation Version 7.2.0
Oracle ≫ Healthcare Foundation Version 7.2.1
Oracle ≫ Healthcare Foundation Version 7.3.0
Oracle ≫ Hospitality Simphony Version >= 19.1.0 <= 19.1.2
Oracle ≫ Hospitality Simphony Version 18.1
Oracle ≫ Hospitality Simphony Version 18.2
Oracle ≫ Insurance Data Foundation Version >= 8.0.6 <= 8.1.0
Oracle ≫ Insurance Insbridge Rating And Underwriting Version >= 5.0.0.0 <= 5.6.0.0
Oracle ≫ Jdeveloper Version 11.1.1.9.0
Oracle ≫ Jdeveloper Version 12.2.1.3.0
Oracle ≫ Jdeveloper Version 12.2.1.4.0
Oracle ≫ Policy Automation Version >= 12.2.0 <= 12.2.20
Oracle ≫ Policy Automation For Mobile Devices Version >= 12.2.0 <= 12.2.20
Oracle ≫ Retail Back Office Version 14.0
Oracle ≫ Retail Back Office Version 14.1
Oracle ≫ Siebel Ui Framework Version 20.8
Oracle ≫ Storagetek Acsls Version 8.5.1
Oracle ≫ Weblogic Server Version 10.3.6.0.0
Oracle ≫ Weblogic Server Version 12.1.3.0.0
Oracle ≫ Weblogic Server Version 12.2.1.3.0
Oracle ≫ Weblogic Server Version 12.2.1.4.0
Oracle ≫ Weblogic Server Version 14.1.1.0.0
Netapp ≫ Max Data Version -
Netapp ≫ Oncommand Insight Version -
Netapp ≫ Oncommand System Manager Version >= 3.0 <= 3.1.3
Netapp ≫ Snapcenter Version -
Netapp ≫ H300s Firmware Version -
   Netapp ≫ H300s Version -
Netapp ≫ H500s Firmware Version -
   Netapp ≫ H500s Version -
Netapp ≫ H700s Firmware Version -
   Netapp ≫ H700s Version -
Netapp ≫ H300e Firmware Version -
   Netapp ≫ H300e Version -
Netapp ≫ H500e Firmware Version -
   Netapp ≫ H500e Version -
Netapp ≫ H700e Firmware Version -
   Netapp ≫ H700e Version -
Netapp ≫ H410s Firmware Version -
   Netapp ≫ H410s Version -
Netapp ≫ H410c Firmware Version -
   Netapp ≫ H410c Version -
Opensuse ≫ Leap Version 15.1
Opensuse ≫ Leap Version 15.2
Tenable ≫ Log Correlation Engine Version < 6.0.9
Oracle ≫ Banking Digital Experience Version >= 18.1 <= 20.1
Oracle ≫ Enterprise Manager Ops Center Version 12.4.0.0
Oracle ≫ Financial Services Data Foundation Version >= 8.0.6 <= 8.1.0
Oracle ≫ Healthcare Foundation Version 7.1.1
Oracle ≫ Healthcare Foundation Version 7.2.0
Oracle ≫ Healthcare Foundation Version 7.2.1
Oracle ≫ Healthcare Foundation Version 7.3.0
Oracle ≫ Hospitality Simphony Version 18.1
Oracle ≫ Hospitality Simphony Version 18.2
Oracle ≫ Hospitality Simphony Version 19.1.0-19.1.2
Oracle ≫ Insurance Data Foundation Version 8.0.6-8.1.0
Oracle ≫ Insurance Insbridge Rating And Underwriting Version >= 5.0.0.0 <= 5.6.0.0
Oracle ≫ Jdeveloper Version 11.1.1.9.0
Oracle ≫ Jdeveloper Version 12.2.1.3.0
Oracle ≫ Jdeveloper Version 12.2.1.4.0
Oracle ≫ Policy Automation Version >= 12.2.0 <= 12.2.20
Oracle ≫ Policy Automation For Mobile Devices Version >= 12.2.0 <= 12.2.20
Oracle ≫ Retail Back Office Version 14.0
Oracle ≫ Retail Back Office Version 14.1
Oracle ≫ Siebel Ui Framework Version 20.8
Oracle ≫ Weblogic Server Version 10.3.6.0.0
Oracle ≫ Weblogic Server Version 12.1.3.0.0
Oracle ≫ Weblogic Server Version 12.2.1.3.0
Oracle ≫ Weblogic Server Version 12.2.1.4.0
Oracle ≫ Weblogic Server Version 14.1.1.0.0
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 99.02% 0.999
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 6.1 2.8 2.7
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
NIST 4.3 8.6 2.9
AV:N/AC:M/Au:N/C:N/I:P/A:N
security-advisories@github.com 6.9 1.6 4.7
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

https://www.oracle.com/security-alerts/cpujan2021.html
Third Party Advisory
https://www.oracle.com/security-alerts/cpuapr2022.html
Patch
Third Party Advisory
https://www.oracle.com/security-alerts/cpujan2022.html
Patch
Third Party Advisory
https://www.oracle.com//security-alerts/cpujul2021.html
Patch
Third Party Advisory
https://www.oracle.com/security-alerts/cpuoct2021.html
Patch
Third Party Advisory
https://www.oracle.com/security-alerts/cpujul2020.html
Third Party Advisory
https://www.oracle.com/security-alerts/cpuoct2020.html
Third Party Advisory
https://www.oracle.com/security-alerts/cpuApr2021.html
Patch
Third Party Advisory
https://www.oracle.com/security-alerts/cpujul2022.html
https://lists.debian.org/debian-lts-announce/2023/08/msg00040.html
https://www.oracle.com/security-alerts/cpujul2021.html
https://www.tenable.com/security/tns-2020-11
Third Party Advisory
https://www.tenable.com/security/tns-2021-10
Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VOE7P7APPRQKD4FGNHBKJPDY6FFCOH3W/
http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00067.html
Broken Link
http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00085.html
Broken Link
http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00039.html
Broken Link
https://blog.jquery.com/2020/04/10/jquery-3-5-0-released
https://jquery.com/upgrade-guide/3.5/
Vendor Advisory
Mitigation
https://lists.apache.org/thread.html/r0483ba0072783c2e1bfea613984bfb3c86e73ba8879d780dc1cc7d36%40%3Cissues.flink.apache.org%3E
https://lists.apache.org/thread.html/r49ce4243b4738dd763caeb27fa8ad6afb426ae3e8c011ff00b8b1f48%40%3Cissues.flink.apache.org%3E
https://lists.apache.org/thread.html/r54565a8f025c7c4f305355fdfd75b68eca442eebdb5f31c2e7d977ae%40%3Cissues.flink.apache.org%3E
https://lists.apache.org/thread.html/r564585d97bc069137e64f521e68ba490c7c9c5b342df5d73c49a0760%40%3Cissues.flink.apache.org%3E
https://lists.apache.org/thread.html/r706cfbc098420f7113968cc377247ec3d1439bce42e679c11c609e2d%40%3Cissues.flink.apache.org%3E
https://lists.apache.org/thread.html/r8f70b0f65d6bedf316ecd899371fd89e65333bc988f6326d2956735c%40%3Cissues.flink.apache.org%3E
https://lists.apache.org/thread.html/rbb448222ba62c430e21e13f940be4cb5cfc373cd3bce56b48c0ffa67%40%3Cdev.flink.apache.org%3E
https://lists.apache.org/thread.html/re4ae96fa5c1a2fe71ccbb7b7ac1538bd0cb677be270a2bf6e2f8d108%40%3Cissues.flink.apache.org%3E
https://lists.apache.org/thread.html/rede9cfaa756e050a3d83045008f84a62802fc68c17f2b4eabeaae5e4%40%3Cissues.flink.apache.org%3E
https://lists.apache.org/thread.html/ree3bd8ddb23df5fa4e372d11c226830ea3650056b1059f3965b3fce2%40%3Cissues.flink.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/03/msg00033.html
Third Party Advisory
Mailing List
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AVKYXLWCLZBV2N7M46KYK4LVA5OXWPBY/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QPN2L2XVQGUA2V5HNQJWHK3APSK3VN7K/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SAPQVX3XDNPGFT26QAQ6AJIXZZBZ4CD4/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SFP4UK4EGP4AFH2MWYJ5A5Z4I7XVFQ6B/
https://security.gentoo.org/glsa/202007-03
Third Party Advisory
https://security.netapp.com/advisory/ntap-20200511-0006/
Third Party Advisory
https://www.debian.org/security/2020/dsa-4693
Third Party Advisory
https://www.drupal.org/sa-core-2020-002
Third Party Advisory
https://www.tenable.com/security/tns-2021-02
Third Party Advisory
http://packetstormsecurity.com/files/162159/jQuery-1.2-Cross-Site-Scripting.html
Third Party Advisory
Exploit
VDB Entry
https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/
Vendor Advisory
Release Notes
https://github.com/jquery/jquery/commit/1d61fd9407e6fbe82fe55cb0b938307aa0791f77
Patch
Third Party Advisory
https://github.com/jquery/jquery/security/advisories/GHSA-gxr4-xjj5-5px2
Third Party Advisory
Mitigation
https://lists.apache.org/thread.html/rdf44341677cf7eec7e9aa96dcf3f37ed709544863d619cca8c36f133%40%3Ccommits.airflow.apache.org%3E
https://www.tenable.com/security/tns-2020-10
Third Party Advisory
http://security.netapp.com/advisory/ntap-20200511-0006
https://github.com/jquery/jquery/releases/tag/3.5.0
https://github.com/maximebf/php-debugbar/commit/847216e60544258c881f2733d699bbcfeefac0fc
https://github.com/maximebf/php-debugbar/issues/447
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/jquery-rails/CVE-2020-11022.yml
https://jquery.com/upgrade-guide/3.5
https://lists.apache.org/thread.html/r0483ba0072783c2e1bfea613984bfb3c86e73ba8879d780dc1cc7d36@%3Cissues.flink.apache.org%3E
https://lists.apache.org/thread.html/r49ce4243b4738dd763caeb27fa8ad6afb426ae3e8c011ff00b8b1f48@%3Cissues.flink.apache.org%3E
https://lists.apache.org/thread.html/r54565a8f025c7c4f305355fdfd75b68eca442eebdb5f31c2e7d977ae@%3Cissues.flink.apache.org%3E
https://lists.apache.org/thread.html/r564585d97bc069137e64f521e68ba490c7c9c5b342df5d73c49a0760@%3Cissues.flink.apache.org%3E
https://lists.apache.org/thread.html/r706cfbc098420f7113968cc377247ec3d1439bce42e679c11c609e2d@%3Cissues.flink.apache.org%3E
https://lists.apache.org/thread.html/r8f70b0f65d6bedf316ecd899371fd89e65333bc988f6326d2956735c@%3Cissues.flink.apache.org%3E
https://lists.apache.org/thread.html/rbb448222ba62c430e21e13f940be4cb5cfc373cd3bce56b48c0ffa67@%3Cdev.flink.apache.org%3E
https://lists.apache.org/thread.html/rdf44341677cf7eec7e9aa96dcf3f37ed709544863d619cca8c36f133@%3Ccommits.airflow.apache.org%3E
https://lists.apache.org/thread.html/re4ae96fa5c1a2fe71ccbb7b7ac1538bd0cb677be270a2bf6e2f8d108@%3Cissues.flink.apache.org%3E
https://lists.apache.org/thread.html/rede9cfaa756e050a3d83045008f84a62802fc68c17f2b4eabeaae5e4@%3Cissues.flink.apache.org%3E
https://lists.apache.org/thread.html/ree3bd8ddb23df5fa4e372d11c226830ea3650056b1059f3965b3fce2@%3Cissues.flink.apache.org%3E
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AVKYXLWCLZBV2N7M46KYK4LVA5OXWPBY
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QPN2L2XVQGUA2V5HNQJWHK3APSK3VN7K
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SAPQVX3XDNPGFT26QAQ6AJIXZZBZ4CD4
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SFP4UK4EGP4AFH2MWYJ5A5Z4I7XVFQ6B
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VOE7P7APPRQKD4FGNHBKJPDY6FFCOH3W
https://lists.opensuse.org/opensuse-security-announce/2020-07/msg00067.html
https://lists.opensuse.org/opensuse-security-announce/2020-07/msg00085.html
https://lists.opensuse.org/opensuse-security-announce/2020-11/msg00039.html
https://packetstormsecurity.com/files/162159/jQuery-1.2-Cross-Site-Scripting.html