CVE-2020-11022
Medium
Description
In jQuery starting with 1.12.0 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.
SeverityMedium
CVSS6.9
Exploit probability100. percentile99.2%
Product
Jquery
PublishedApr 29, 2020
Weakness typeCWE-79Cross-site scripting (XSS)
How to fix
Update
- jquery jquery3.5.0 or later
- drupal drupal7.70, 8.7.14, 8.8.6 or later
- oracle blockchain_platform21.1.2 or later
- tenable log_correlation_engine6.0.9 or later
Vendor advisories
- debian.org/security/2020/dsa-4693
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VOE7P7APPRQKD4FGNHBKJPDY6FFCOH3W/
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QPN2L2XVQGUA2V5HNQJWHK3APSK3VN7K/
- security.gentoo.org/glsa/202007-03
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SFP4UK4EGP4AFH2MWYJ5A5Z4I7XVFQ6B/
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AVKYXLWCLZBV2N7M46KYK4LVA5OXWPBY/
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SAPQVX3XDNPGFT26QAQ6AJIXZZBZ4CD4/
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| jquery jquery | 1.2 ≤ v < 3.5.0 | 3.5.0 |
| drupal drupal | 7.0 ≤ v < 7.70, 8.7.0 ≤ v < 8.7.14, 8.8.0 ≤ v < 8.8.6 | 7.70, 8.7.14, 8.8.6 |
| debian debian_linux | 9.0 | — |
| fedoraproject fedora | 31, 32, 33 | — |
| oracle agile_product_lifecycle_management_for_process | 6.2.0.0 | — |
| oracle application_testing_suite | 13.3.0.1 | — |
| oracle banking_digital_experience | 18.1, 18.2, 18.3, 19.1, 19.2, 20.1, 18.1 ≤ v ≤ 20.1 | — |
| oracle blockchain_platform | v < 21.1.2 | 21.1.2 |
| oracle communications_application_session_controller | 3.8m0 | — |
| oracle communications_billing_and_revenue_management | 7.5.0.23.0, 12.0.0.3.0 | — |
| oracle communications_diameter_signaling_router_idih\ | 8.0.0 ≤ v ≤ 8.2.2 | — |
| oracle communications_eagle_application_processor | 16.1.0 ≤ v ≤ 16.4.0 | — |
| oracle communications_services_gatekeeper | 7.0 | — |
| oracle communications_webrtc_session_controller | 7.2 | — |
| oracle enterprise_manager_ops_center | 12.4.0.0 | — |
| oracle enterprise_session_border_controller | 8.4 | — |
| oracle financial_services_analytical_applications_infrastructure | 8.0.6.0.0 ≤ v ≤ 8.1.0.0.0, 8.0.6 ≤ v ≤ 8.1.0 | — |
| oracle financial_services_analytical_applications_reconciliation_framework | 8.0.6 ≤ v ≤ 8.0.8, 8.1.0 | — |
| oracle financial_services_asset_liability_management | 8.0.6, 8.0.7, 8.1.0 | — |
| oracle financial_services_balance_sheet_planning | 8.0.8 | — |
| oracle financial_services_basel_regulatory_capital_basic | 8.0.6 ≤ v ≤ 8.0.8, 8.1.0 | — |
| oracle financial_services_basel_regulatory_capital_internal_ratings_based_approach | 8.0.6 ≤ v ≤ 8.0.8, 8.1.0 | — |
| oracle financial_services_data_foundation | 8.0.6 ≤ v ≤ 8.1.0 | — |
| oracle financial_services_data_governance_for_us_regulatory_reporting | 8.0.6 ≤ v ≤ 8.0.9 | — |
| oracle financial_services_data_integration_hub | 8.0.6, 8.0.7, 8.1.0 | — |
| oracle financial_services_funds_transfer_pricing | 8.0.6, 8.0.7, 8.1.0 | — |
| oracle financial_services_hedge_management_and_ifrs_valuations | 8.0.6 ≤ v ≤ 8.0.8, 8.1.0 | — |
| oracle financial_services_institutional_performance_analytics | 8.0.6, 8.0.7, 8.1.0 | — |
| oracle financial_services_liquidity_risk_management | 8.0.6 | — |
| oracle financial_services_liquidity_risk_measurement_and_management | 8.0.7, 8.0.8, 8.1.0 | — |
| oracle financial_services_loan_loss_forecasting_and_provisioning | 8.0.6 ≤ v ≤ 8.0.8, 8.1.0 | — |
| oracle financial_services_market_risk_measurement_and_management | 8.0.6, 8.0.8 | — |
| oracle financial_services_price_creation_and_discovery | 8.0.6, 8.0.7 | — |
| oracle financial_services_profitability_management | 8.0.6, 8.0.7, 8.1.0 | — |
| oracle financial_services_regulatory_reporting_for_european_banking_authority | 8.0.6 ≤ v ≤ 8.1.0 | — |
| oracle financial_services_regulatory_reporting_for_us_federal_reserve | 8.0.6 ≤ v ≤ 8.0.9 | — |
| oracle healthcare_foundation | 7.1.1, 7.2.0, 7.2.1, 7.3.0 | — |
| oracle hospitality_materials_control | 18.1 | — |
| oracle hospitality_simphony | 19.1.0 ≤ v ≤ 19.1.2, 18.1, 18.2, 19.1.0-19.1.2 | — |
| oracle insurance_accounting_analyzer | 8.0.9 | — |
| oracle insurance_allocation_manager_for_enterprise_profitability | 8.0.8, 8.1.0 | — |
| oracle insurance_data_foundation | 8.0.6 ≤ v ≤ 8.1.0, 8.0.6-8.1.0 | — |
| oracle insurance_insbridge_rating_and_underwriting | 5.0.0.0 ≤ v ≤ 5.6.0.0, 5.6.1.0 | — |
| oracle jdeveloper | 11.1.1.9.0, 12.2.1.3.0, 12.2.1.4.0 | — |
| oracle peoplesoft_enterprise_peopletools | 8.56, 8.57, 8.58 | — |
| oracle policy_automation | 12.2.0 ≤ v ≤ 12.2.20 | — |
| oracle policy_automation_connector_for_siebel | 10.4.6 | — |
| oracle policy_automation_for_mobile_devices | 12.2.0 ≤ v ≤ 12.2.20 | — |
| oracle retail_back_office | 14.0, 14.1 | — |
| oracle retail_customer_management_and_segmentation_foundation | 19.0 | — |
| oracle retail_returns_management | 14.0, 14.1 | — |
| oracle siebel_ui_framework | 20.8 | — |
| oracle storagetek_acsls | 8.5.1 | — |
| oracle weblogic_server | 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0 | — |
| netapp max_data | No range specified | — |
| netapp oncommand_insight | No range specified | — |
| netapp oncommand_system_manager | 3.0 ≤ v ≤ 3.1.3 | — |
| netapp snap_creator_framework | No range specified | — |
| netapp snapcenter | No range specified | — |
| netapp h300s_firmware | No range specified | — |
| netapp h500s_firmware | No range specified | — |
| netapp h700s_firmware | No range specified | — |
| netapp h300e_firmware | No range specified | — |
| netapp h500e_firmware | No range specified | — |
| netapp h700e_firmware | No range specified | — |
| netapp h410s_firmware | No range specified | — |
| netapp h410c_firmware | No range specified | — |
| opensuse leap | 15.1, 15.2 | — |
| tenable log_correlation_engine | v < 6.0.9 | 6.0.9 |
| oracle agile_product_supplier_collaboration_for_process | 6.2.0.0 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.