6.9

CVE-2020-11023

Warning
Exploit

In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.

Data is provided by the National Vulnerability Database (NVD)
Jquery ≫ Jquery Version >= 1.0.3 < 3.5.0
Debian ≫ Debian Linux Version9.0
Fedoraproject ≫ Fedora Version31
Fedoraproject ≫ Fedora Version32
Fedoraproject ≫ Fedora Version33
Drupal ≫ Drupal Version >= 7.0 < 7.70
Drupal ≫ Drupal Version >= 8.7.0 < 8.7.14
Drupal ≫ Drupal Version >= 8.8.0 < 8.8.6
Oracle ≫ Application Express Version < 20.2
Oracle ≫ Application Testing Suite Version13.3.0.1
Oracle ≫ Banking Enterprise Collections Version >= 2.7.0 <= 2.8.0
Oracle ≫ Banking Platform Version >= 2.4.0 <= 2.10.0
Oracle ≫ Business Intelligence Version5.9.0.0.0 SwEditionenterprise
Oracle ≫ Communications Analytics Version12.1.1
Oracle ≫ Communications Eagle Application Processor Version >= 16.1.0 <= 16.4.0
Oracle ≫ Communications Operations Monitor Version >= 4.1 <= 4.3
Oracle ≫ Health Sciences Inform Version6.3.0
Oracle ≫ Hyperion Financial Reporting Version11.1.2.4
Oracle ≫ Jd Edwards Enterpriseone Tools Version < 9.2.5.0
Oracle ≫ Oss Support Tools Version < 2.12.41
Oracle ≫ Primavera Gateway Version >= 16.2 <= 16.2.11
Oracle ≫ Primavera Gateway Version >= 17.12.0 <= 17.12.7
Oracle ≫ Primavera Gateway Version >= 18.8.0 <= 18.8.9
Oracle ≫ Primavera Gateway Version >= 19.12.0 <= 19.12.4
Oracle ≫ Rest Data Services Version11.2.0.4 SwEdition-
Oracle ≫ Rest Data Services Version12.1.0.2 SwEdition-
Oracle ≫ Rest Data Services Version12.2.0.1 SwEdition-
Oracle ≫ Rest Data Services Version18c SwEdition-
Oracle ≫ Rest Data Services Version19c SwEdition-
Oracle ≫ Siebel Mobile Version <= 20.12
Oracle ≫ Storagetek Acsls Version8.5.1
Oracle ≫ Webcenter Sites Version12.2.1.3.0
Oracle ≫ Webcenter Sites Version12.2.1.4.0
Oracle ≫ Weblogic Server Version12.1.3.0.0
Oracle ≫ Weblogic Server Version12.2.1.3.0
Oracle ≫ Weblogic Server Version12.2.1.4.0
Oracle ≫ Weblogic Server Version14.1.1.0.0
Netapp ≫ H300s Firmware Version-
   Netapp ≫ H300s Version-
Netapp ≫ H500s Firmware Version-
   Netapp ≫ H500s Version-
Netapp ≫ H700s Firmware Version-
   Netapp ≫ H700s Version-
Netapp ≫ H300e Firmware Version-
   Netapp ≫ H300e Version-
Netapp ≫ H500e Firmware Version-
   Netapp ≫ H500e Version-
Netapp ≫ H700e Firmware Version-
   Netapp ≫ H700e Version-
Netapp ≫ H410s Firmware Version-
   Netapp ≫ H410s Version-
Netapp ≫ H410c Firmware Version-
   Netapp ≫ H410c Version-
Netapp ≫ Max Data Version-
Netapp ≫ Oncommand Insight Version-
Netapp ≫ Oncommand System Manager Version >= 3.0 <= 3.1.3
Netapp ≫ Snapcenter Server Version-
Tenable ≫ Log Correlation Engine Version < 6.0.9

23.01.2025: CISA Known Exploited Vulnerabilities (KEV) Catalog

JQuery Cross-Site Scripting (XSS) Vulnerability

Vulnerability

JQuery contains a persistent cross-site scripting (XSS) vulnerability. When passing maliciously formed, untrusted input enclosed in HTML tags, JQuery's DOM manipulators can execute untrusted code in the context of the user's browser.

Description

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Required actions
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 21.32% 0.955
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 6.1 2.8 2.7
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
nvd@nist.gov 4.3 8.6 2.9
AV:N/AC:M/Au:N/C:N/I:P/A:N
security-advisories@github.com 6.9 1.6 4.7
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

https://jquery.com/upgrade-guide/3.5/
Vendor Advisory
Release Notes