CVEvulnerability

CVE-2020-11023

6.1 MEDIUM Known exploited Published 2020-04-29 Modified 2026-06-17 Official page ↗

CISA Known Exploited Vulnerability

JQuery Cross-Site Scripting (XSS) Vulnerability — JQuery JQuery

JQuery contains a persistent cross-site scripting (XSS) vulnerability. When passing maliciously formed, untrusted input enclosed in HTML tags, JQuery's DOM manipulators can execute untrusted code in the context of the user's browser.

Added to KEV: 2025-01-23
Remediation due: 2025-02-13
Ransomware use: Unknown
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Notes: This vulnerability could affect an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https://github.com/jquery/jquery/security/advisories/GHSA-jpcq-cgw6-v4j6 ; https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/ ; https://nvd.nist.gov/vuln/detail/CVE-2020-11023

Status: Analyzed
Published: 2020-04-29
Last modified: 2026-06-17
Assigner: [email protected]
CVSS 3.1 ([email protected]): 6.9 MEDIUM — CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N
CVSS 3.1 ([email protected]): 6.1 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS 2.0 ([email protected]): 4.3 MEDIUM — AV:N/AC:M/Au:N/C:N/I:P/A:N
Weaknesses: CWE-79

Description

In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.

Affected configurations

• jquery jquery (>= 1.0.3 < 3.5.0) • debian debian linux 9.0 • fedoraproject fedora 31 • fedoraproject fedora 32 • fedoraproject fedora 33 • drupal drupal (>= 7.0 < 7.70) • drupal drupal (>= 8.7.0 < 8.7.14) • drupal drupal (>= 8.8.0 < 8.8.6) • oracle application express (< 20.2) • oracle application testing suite 13.3.0.1 • oracle banking enterprise collections (>= 2.7.0 <= 2.8.0) • oracle banking platform (>= 2.4.0 <= 2.10.0) • oracle blockchain platform (< 21.1.2) • oracle blockchain platform 21.1.2 • oracle business intelligence 5.9.0.0.0 • oracle communications analytics 12.1.1 • oracle communications eagle application processor (>= 16.1.0 <= 16.4.0) • oracle communications element manager 8.1.1 • oracle communications element manager 8.2.0 • oracle communications element manager 8.2.1 • oracle communications interactive session recorder (>= 6.1 <= 6.4) • oracle communications operations monitor (>= 4.1 <= 4.3) • oracle communications operations monitor 3.4 • oracle communications services gatekeeper 7.0 • oracle communications session report manager 8.1.1 • oracle communications session report manager 8.2.0 • oracle communications session report manager 8.2.1 • oracle communications session route manager 8.1.1 • oracle communications session route manager 8.2.0 • oracle communications session route manager 8.2.1 • oracle financial services regulatory reporting for de nederlandsche bank 8.0.4 • oracle financial services revenue management and billing analytics 2.7 • oracle financial services revenue management and billing analytics 2.8 • oracle health sciences inform 6.3.0 • oracle healthcare translational research 3.2.1 • oracle healthcare translational research 3.3.1 • oracle healthcare translational research 3.3.2 • oracle healthcare translational research 3.4.0 • oracle hyperion financial reporting 11.1.2.4 • oracle jd edwards enterpriseone orchestrator (< 9.2.5.0) • oracle jd edwards enterpriseone tools (< 9.2.5.0) • oracle oss support tools (< 2.12.41) • oracle peoplesoft enterprise human capital management resources 9.2 • oracle primavera gateway (>= 16.2 <= 16.2.11) • oracle primavera gateway (>= 17.12.0 <= 17.12.7) • oracle primavera gateway (>= 18.8.0 <= 18.8.9) • oracle primavera gateway (>= 19.12.0 <= 19.12.4) • oracle rest data services 11.2.0.4 • oracle rest data services 12.1.0.2 • oracle rest data services 12.2.0.1 • oracle rest data services 18c • oracle rest data services 19c • oracle siebel mobile (<= 20.12) • oracle storagetek acsls 8.5.1 • oracle storagetek tape analytics sw tool 2.3.1 • oracle webcenter sites 12.2.1.3.0 • oracle webcenter sites 12.2.1.4.0 • oracle weblogic server 12.1.3.0.0 • oracle weblogic server 12.2.1.3.0 • oracle weblogic server 12.2.1.4.0 … and 19 more

Weakness · CWE (1)

CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References