CVSS 3.1
6.1 mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NCVE-2020-11023
Medium (6.1) in JQuery JQuery. In CISA KEV since 2025-01-23. EPSS 85% chance of exploitation in the next 30 days. Fixed in jquery 3.5.0.
In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.
Severity
- EPSS
- 85% chance of exploitation in the next 30 days; higher than 99% of CVEs (scores of 2026-10-31)
- CISA KEV
- listed 2025-01-23, due 2025-02-13
- CWE
- CWE-79
- Published
- Modified
- Record from
- the NVD, synced
Affected
- debian:debian_linux
- drupal:drupal
- fedoraproject:fedora
- jquery:jquery
- netapp:active_iq_unified_manager
- netapp:cloud_backup
- netapp:cloud_insights_storage_workload_security_agent
- netapp:h300e_firmware
- netapp:h300s_firmware
- netapp:h410c_firmware
- netapp:h410s_firmware
- netapp:h500e_firmware
- netapp:h500s_firmware
- netapp:h700e_firmware
- netapp:h700s_firmware
- netapp:hci_baseboard_management_controller
- netapp:max_data
- netapp:oncommand_insight
- netapp:oncommand_system_manager
- netapp:snap_creator_framework
- netapp:snapcenter_server
- oracle:application_express
- oracle:application_testing_suite
- oracle:banking_enterprise_collections
- oracle:banking_platform
- oracle:blockchain_platform
- oracle:business_intelligence
- oracle:communications_analytics
- oracle:communications_eagle_application_processor
- oracle:communications_element_manager
- oracle:communications_interactive_session_recorder
- oracle:communications_operations_monitor
- oracle:communications_services_gatekeeper
- oracle:communications_session_report_manager
- oracle:communications_session_route_manager
- oracle:financial_services_regulatory_reporting_for_de_nederlandsche_bank
- oracle:financial_services_revenue_management_and_billing_analytics
- oracle:health_sciences_inform
- oracle:healthcare_translational_research
- oracle:hyperion_financial_reporting
- oracle:jd_edwards_enterpriseone_orchestrator
- oracle:jd_edwards_enterpriseone_tools
- oracle:oss_support_tools
- oracle:peoplesoft_enterprise_human_capital_management_resources
- oracle:primavera_gateway
- oracle:rest_data_services
- oracle:siebel_mobile
- oracle:storagetek_acsls
- oracle:storagetek_tape_analytics_sw_tool
- oracle:webcenter_sites
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-jpcq-cgw6-v4j6 | npm | jquery | >=1.0.3 <3.5.0 | 3.5.0 |
| GHSA-jpcq-cgw6-v4j6 | RubyGems | jquery-rails | <4.4.0 | 4.4.0 |
| GHSA-jpcq-cgw6-v4j6 | NuGet | jQuery | >=1.0.3 <3.5.0 | 3.5.0 |
| GHSA-jpcq-cgw6-v4j6 | Maven | org.webjars.npm:jquery | >=1.0.3 <3.5.0 | 3.5.0 |
| GHSA-jpcq-cgw6-v4j6 | Packagist | components/jquery | >=1.0.3 <3.5.0 | 3.5.0 |
References
- http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00067.html
- http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00085.html
- http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00039.html
- http://packetstormsecurity.com/files/162160/jQuery-1.0.3-Cross-Site-Scripting.html
- https://blog.jquery.com/2020/04/10/jquery-3-5-0-released