CVE-2020-11023
MediumActively exploited (CISA KEV)
Description
In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.
SeverityMedium
CVSS6.9
Exploit probability100. percentile84.9%
Product
JQuery
PublishedApr 29, 2020
Added to KEVJan 23, 2025
Weakness typeCWE-79Cross-site scripting (XSS)
How to fix
CISA required action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CISA due date: Feb 13, 2025Update
- jquery jquery3.5.0 or later
- drupal drupal7.70, 8.7.14, 8.8.6 or later
- oracle application_express20.2 or later
- oracle blockchain_platform21.1.2 or later
- oracle jd_edwards_enterpriseone_orchestrator9.2.5.0 or later
- oracle jd_edwards_enterpriseone_tools9.2.5.0 or later
- oracle oss_support_tools2.12.41 or later
- tenable log_correlation_engine6.0.9 or later
Vendor advisories
- debian.org/security/2020/dsa-4693
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QPN2L2XVQGUA2V5HNQJWHK3APSK3VN7K/
- security.gentoo.org/glsa/202007-03
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SFP4UK4EGP4AFH2MWYJ5A5Z4I7XVFQ6B/
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AVKYXLWCLZBV2N7M46KYK4LVA5OXWPBY/
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SAPQVX3XDNPGFT26QAQ6AJIXZZBZ4CD4/
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| jquery jquery | 1.0.3 ≤ v < 3.5.0 | 3.5.0 |
| debian debian_linux | 9.0 | — |
| fedoraproject fedora | 31, 32, 33 | — |
| drupal drupal | 7.0 ≤ v < 7.70, 8.7.0 ≤ v < 8.7.14, 8.8.0 ≤ v < 8.8.6 | 7.70, 8.7.14, 8.8.6 |
| oracle application_express | v < 20.2 | 20.2 |
| oracle application_testing_suite | 13.3.0.1 | — |
| oracle banking_enterprise_collections | 2.7.0 ≤ v ≤ 2.8.0 | — |
| oracle banking_platform | 2.4.0 ≤ v ≤ 2.10.0 | — |
| oracle blockchain_platform | v < 21.1.2, 21.1.2 | 21.1.2 |
| oracle business_intelligence | 5.9.0.0.0 | — |
| oracle communications_analytics | 12.1.1 | — |
| oracle communications_eagle_application_processor | 16.1.0 ≤ v ≤ 16.4.0 | — |
| oracle communications_element_manager | 8.1.1, 8.2.0, 8.2.1 | — |
| oracle communications_interactive_session_recorder | 6.1 ≤ v ≤ 6.4 | — |
| oracle communications_operations_monitor | 4.1 ≤ v ≤ 4.3, 3.4 | — |
| oracle communications_services_gatekeeper | 7.0 | — |
| oracle communications_session_report_manager | 8.1.1, 8.2.0, 8.2.1 | — |
| oracle communications_session_route_manager | 8.1.1, 8.2.0, 8.2.1 | — |
| oracle financial_services_regulatory_reporting_for_de_nederlandsche_bank | 8.0.4 | — |
| oracle financial_services_revenue_management_and_billing_analytics | 2.7, 2.8 | — |
| oracle health_sciences_inform | 6.3.0 | — |
| oracle healthcare_translational_research | 3.2.1, 3.3.1, 3.3.2, 3.4.0 | — |
| oracle hyperion_financial_reporting | 11.1.2.4 | — |
| oracle jd_edwards_enterpriseone_orchestrator | v < 9.2.5.0 | 9.2.5.0 |
| oracle jd_edwards_enterpriseone_tools | v < 9.2.5.0 | 9.2.5.0 |
| oracle oss_support_tools | v < 2.12.41 | 2.12.41 |
| oracle peoplesoft_enterprise_human_capital_management_resources | 9.2 | — |
| oracle primavera_gateway | 16.2 ≤ v ≤ 16.2.11, 17.12.0 ≤ v ≤ 17.12.7, 18.8.0 ≤ v ≤ 18.8.9, 19.12.0 ≤ v ≤ 19.12.4 | — |
| oracle rest_data_services | 11.2.0.4, 12.1.0.2, 12.2.0.1, 18c, 19c | — |
| oracle siebel_mobile | v ≤ 20.12 | — |
| oracle storagetek_acsls | 8.5.1 | — |
| oracle storagetek_tape_analytics_sw_tool | 2.3.1 | — |
| oracle webcenter_sites | 12.2.1.3.0, 12.2.1.4.0 | — |
| oracle weblogic_server | 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0 | — |
| netapp h300s_firmware | No range specified | — |
| netapp h500s_firmware | No range specified | — |
| netapp h700s_firmware | No range specified | — |
| netapp h300e_firmware | No range specified | — |
| netapp h500e_firmware | No range specified | — |
| netapp h700e_firmware | No range specified | — |
| netapp h410s_firmware | No range specified | — |
| netapp h410c_firmware | No range specified | — |
| netapp active_iq_unified_manager | No range specified | — |
| netapp cloud_backup | No range specified | — |
| netapp cloud_insights_storage_workload_security_agent | No range specified | — |
| netapp hci_baseboard_management_controller | No range specified | — |
| netapp max_data | No range specified | — |
| netapp oncommand_insight | No range specified | — |
| netapp oncommand_system_manager | 3.0 ≤ v ≤ 3.1.3 | — |
| netapp snap_creator_framework | No range specified | — |
| netapp snapcenter_server | No range specified | — |
| tenable log_correlation_engine | v < 6.0.9 | 6.0.9 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.