CVSS 3.1
6.1 mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NCVE-2020-11022
Medium (6.1). EPSS 99% chance of exploitation in the next 30 days. Fixed in jquery 3.5.0.
In jQuery starting with 1.12.0 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.
Severity
- EPSS
- 99% chance of exploitation in the next 30 days; higher than 99% of CVEs (scores of 2026-10-31)
- CWE
- CWE-79
- Published
- Modified
- Record from
- the NVD, synced
Affected
- debian:debian_linux
- drupal:drupal
- fedoraproject:fedora
- jquery:jquery
- netapp:h300e_firmware
- netapp:h300s_firmware
- netapp:h410c_firmware
- netapp:h410s_firmware
- netapp:h500e_firmware
- netapp:h500s_firmware
- netapp:h700e_firmware
- netapp:h700s_firmware
- netapp:max_data
- netapp:oncommand_insight
- netapp:oncommand_system_manager
- netapp:snap_creator_framework
- netapp:snapcenter
- opensuse:leap
- oracle:agile_product_lifecycle_management_for_process
- oracle:agile_product_supplier_collaboration_for_process
- oracle:application_testing_suite
- oracle:banking_digital_experience
- oracle:blockchain_platform
- oracle:communications_application_session_controller
- oracle:communications_billing_and_revenue_management
- oracle:communications_diameter_signaling_router_idih\
- oracle:communications_eagle_application_processor
- oracle:communications_services_gatekeeper
- oracle:communications_webrtc_session_controller
- oracle:enterprise_manager_ops_center
- oracle:enterprise_session_border_controller
- oracle:financial_services_analytical_applications_infrastructure
- oracle:financial_services_analytical_applications_reconciliation_framework
- oracle:financial_services_asset_liability_management
- oracle:financial_services_balance_sheet_planning
- oracle:financial_services_basel_regulatory_capital_basic
- oracle:financial_services_basel_regulatory_capital_internal_ratings_based_approach
- oracle:financial_services_data_foundation
- oracle:financial_services_data_governance_for_us_regulatory_reporting
- oracle:financial_services_data_integration_hub
- oracle:financial_services_funds_transfer_pricing
- oracle:financial_services_hedge_management_and_ifrs_valuations
- oracle:financial_services_institutional_performance_analytics
- oracle:financial_services_liquidity_risk_management
- oracle:financial_services_liquidity_risk_measurement_and_management
- oracle:financial_services_loan_loss_forecasting_and_provisioning
- oracle:financial_services_market_risk_measurement_and_management
- oracle:financial_services_price_creation_and_discovery
- oracle:financial_services_profitability_management
- oracle:financial_services_regulatory_reporting_for_european_banking_authority
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-gxr4-xjj5-5px2 | npm | jquery | >=1.12.0 <3.5.0 | 3.5.0 |
| GHSA-gxr4-xjj5-5px2 | NuGet | jquery | >=1.12.0 <3.5.0 | 3.5.0 |
| GHSA-gxr4-xjj5-5px2 | RubyGems | jquery-rails | <4.4.0 | 4.4.0 |
| GHSA-gxr4-xjj5-5px2 | Maven | org.webjars.npm:jquery | >=1.12.0 <3.5.0 | 3.5.0 |
| GHSA-gxr4-xjj5-5px2 | Packagist | maximebf/debugbar | <1.19.0 | 1.19.0 |
| GHSA-gxr4-xjj5-5px2 | Packagist | athlon1600/youtube-downloader | <4.0.1 | 4.0.1 |
| GHSA-gxr4-xjj5-5px2 | Packagist | components/jquery | >=1.12.0 <3.5.0 | 3.5.0 |
References
- http://security.netapp.com/advisory/ntap-20200511-0006
- https://blog.jquery.com/2020/04/10/jquery-3-5-0-released
- https://github.com/jquery/jquery/commit/1d61fd9407e6fbe82fe55cb0b938307aa0791f77
- https://github.com/jquery/jquery/releases/tag/3.5.0
- https://github.com/jquery/jquery/security/advisories/GHSA-gxr4-xjj5-5px2