CVE-2020-11022
Orta
Açıklama
jQuery'nin 1.12.0 sürümüyle başlayan ve 3.5.0 sürümünden önceki versiyonlarında, güvenilmeyen kaynaklardan gelen HTML içeriğinin -temizleme işleminden geçirilmiş olsa bile- jQuery'nin DOM manipülasyon yöntemlerinden birine (örneğin .html(), .append() ve diğerleri) aktarılması, güvenilmeyen kodun çalıştırılmasına neden olabilir. Bu sorun jQuery 3.5.0 sürümünde giderilm
ÖnemOrta
CVSS6.9
İstismar olasılığı100. yüzdelik%99,2
Ürün
Jquery
Yayın29 Nis 2020
Zayıflık türüCWE-79Siteler arası betik (XSS)
Nasıl düzeltilir
Güncelleyin
- jquery jquery3.5.0 ya da sonraki bir sürüm
- drupal drupal7.70, 8.7.14, 8.8.6 ya da sonraki bir sürüm
- oracle blockchain_platform21.1.2 ya da sonraki bir sürüm
- tenable log_correlation_engine6.0.9 ya da sonraki bir sürüm
Üretici duyuruları
- debian.org/security/2020/dsa-4693
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VOE7P7APPRQKD4FGNHBKJPDY6FFCOH3W/
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QPN2L2XVQGUA2V5HNQJWHK3APSK3VN7K/
- security.gentoo.org/glsa/202007-03
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SFP4UK4EGP4AFH2MWYJ5A5Z4I7XVFQ6B/
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AVKYXLWCLZBV2N7M46KYK4LVA5OXWPBY/
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SAPQVX3XDNPGFT26QAQ6AJIXZZBZ4CD4/
Etkilenen ürünler
| Ürün | Etkilenen sürümler | Düzeltildiği sürüm |
|---|---|---|
| jquery jquery | 1.2 ≤ v < 3.5.0 | 3.5.0 |
| drupal drupal | 7.0 ≤ v < 7.70, 8.7.0 ≤ v < 8.7.14, 8.8.0 ≤ v < 8.8.6 | 7.70, 8.7.14, 8.8.6 |
| debian debian_linux | 9.0 | — |
| fedoraproject fedora | 31, 32, 33 | — |
| oracle agile_product_lifecycle_management_for_process | 6.2.0.0 | — |
| oracle application_testing_suite | 13.3.0.1 | — |
| oracle banking_digital_experience | 18.1, 18.2, 18.3, 19.1, 19.2, 20.1, 18.1 ≤ v ≤ 20.1 | — |
| oracle blockchain_platform | v < 21.1.2 | 21.1.2 |
| oracle communications_application_session_controller | 3.8m0 | — |
| oracle communications_billing_and_revenue_management | 7.5.0.23.0, 12.0.0.3.0 | — |
| oracle communications_diameter_signaling_router_idih\ | 8.0.0 ≤ v ≤ 8.2.2 | — |
| oracle communications_eagle_application_processor | 16.1.0 ≤ v ≤ 16.4.0 | — |
| oracle communications_services_gatekeeper | 7.0 | — |
| oracle communications_webrtc_session_controller | 7.2 | — |
| oracle enterprise_manager_ops_center | 12.4.0.0 | — |
| oracle enterprise_session_border_controller | 8.4 | — |
| oracle financial_services_analytical_applications_infrastructure | 8.0.6.0.0 ≤ v ≤ 8.1.0.0.0, 8.0.6 ≤ v ≤ 8.1.0 | — |
| oracle financial_services_analytical_applications_reconciliation_framework | 8.0.6 ≤ v ≤ 8.0.8, 8.1.0 | — |
| oracle financial_services_asset_liability_management | 8.0.6, 8.0.7, 8.1.0 | — |
| oracle financial_services_balance_sheet_planning | 8.0.8 | — |
| oracle financial_services_basel_regulatory_capital_basic | 8.0.6 ≤ v ≤ 8.0.8, 8.1.0 | — |
| oracle financial_services_basel_regulatory_capital_internal_ratings_based_approach | 8.0.6 ≤ v ≤ 8.0.8, 8.1.0 | — |
| oracle financial_services_data_foundation | 8.0.6 ≤ v ≤ 8.1.0 | — |
| oracle financial_services_data_governance_for_us_regulatory_reporting | 8.0.6 ≤ v ≤ 8.0.9 | — |
| oracle financial_services_data_integration_hub | 8.0.6, 8.0.7, 8.1.0 | — |
| oracle financial_services_funds_transfer_pricing | 8.0.6, 8.0.7, 8.1.0 | — |
| oracle financial_services_hedge_management_and_ifrs_valuations | 8.0.6 ≤ v ≤ 8.0.8, 8.1.0 | — |
| oracle financial_services_institutional_performance_analytics | 8.0.6, 8.0.7, 8.1.0 | — |
| oracle financial_services_liquidity_risk_management | 8.0.6 | — |
| oracle financial_services_liquidity_risk_measurement_and_management | 8.0.7, 8.0.8, 8.1.0 | — |
| oracle financial_services_loan_loss_forecasting_and_provisioning | 8.0.6 ≤ v ≤ 8.0.8, 8.1.0 | — |
| oracle financial_services_market_risk_measurement_and_management | 8.0.6, 8.0.8 | — |
| oracle financial_services_price_creation_and_discovery | 8.0.6, 8.0.7 | — |
| oracle financial_services_profitability_management | 8.0.6, 8.0.7, 8.1.0 | — |
| oracle financial_services_regulatory_reporting_for_european_banking_authority | 8.0.6 ≤ v ≤ 8.1.0 | — |
| oracle financial_services_regulatory_reporting_for_us_federal_reserve | 8.0.6 ≤ v ≤ 8.0.9 | — |
| oracle healthcare_foundation | 7.1.1, 7.2.0, 7.2.1, 7.3.0 | — |
| oracle hospitality_materials_control | 18.1 | — |
| oracle hospitality_simphony | 19.1.0 ≤ v ≤ 19.1.2, 18.1, 18.2, 19.1.0-19.1.2 | — |
| oracle insurance_accounting_analyzer | 8.0.9 | — |
| oracle insurance_allocation_manager_for_enterprise_profitability | 8.0.8, 8.1.0 | — |
| oracle insurance_data_foundation | 8.0.6 ≤ v ≤ 8.1.0, 8.0.6-8.1.0 | — |
| oracle insurance_insbridge_rating_and_underwriting | 5.0.0.0 ≤ v ≤ 5.6.0.0, 5.6.1.0 | — |
| oracle jdeveloper | 11.1.1.9.0, 12.2.1.3.0, 12.2.1.4.0 | — |
| oracle peoplesoft_enterprise_peopletools | 8.56, 8.57, 8.58 | — |
| oracle policy_automation | 12.2.0 ≤ v ≤ 12.2.20 | — |
| oracle policy_automation_connector_for_siebel | 10.4.6 | — |
| oracle policy_automation_for_mobile_devices | 12.2.0 ≤ v ≤ 12.2.20 | — |
| oracle retail_back_office | 14.0, 14.1 | — |
| oracle retail_customer_management_and_segmentation_foundation | 19.0 | — |
| oracle retail_returns_management | 14.0, 14.1 | — |
| oracle siebel_ui_framework | 20.8 | — |
| oracle storagetek_acsls | 8.5.1 | — |
| oracle weblogic_server | 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0 | — |
| netapp max_data | Aralık belirtilmemiş | — |
| netapp oncommand_insight | Aralık belirtilmemiş | — |
| netapp oncommand_system_manager | 3.0 ≤ v ≤ 3.1.3 | — |
| netapp snap_creator_framework | Aralık belirtilmemiş | — |
| netapp snapcenter | Aralık belirtilmemiş | — |
| netapp h300s_firmware | Aralık belirtilmemiş | — |
| netapp h500s_firmware | Aralık belirtilmemiş | — |
| netapp h700s_firmware | Aralık belirtilmemiş | — |
| netapp h300e_firmware | Aralık belirtilmemiş | — |
| netapp h500e_firmware | Aralık belirtilmemiş | — |
| netapp h700e_firmware | Aralık belirtilmemiş | — |
| netapp h410s_firmware | Aralık belirtilmemiş | — |
| netapp h410c_firmware | Aralık belirtilmemiş | — |
| opensuse leap | 15.1, 15.2 | — |
| tenable log_correlation_engine | v < 6.0.9 | 6.0.9 |
| oracle agile_product_supplier_collaboration_for_process | 6.2.0.0 | — |
Sürümünüzü kontrol edin
Ürünü seçin ve kullandığınız sürümü yazın; sürümün etkilenen aralıkta olup olmadığını görün.
Intelligence 360 paketinde
Attack Surface Management
Alan adlarınıza bağlı varlıkları, bu varlıklarda çalışan teknolojileri ve bilinen zafiyetleri tek listede görün.