CVE-2020-11023

Published: Apr 29, 2020Modified: Jun 17, 2026CISA KEV

6.1

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.8 / Impact: 2.7

Source: NVD

Description

In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.

Affected (81)

Products: Jquery: Jquery · Debian: Debian Linux · Fedoraproject: Fedora · +4 more

Show all products

Jquery: Jquery · Debian: Debian Linux · Fedoraproject: Fedora · Drupal: Drupal · Oracle: Application Express, Application Testing Suite, Banking Enterprise Collections, Banking Platform, Blockchain Platform, Business Intelligence, Communications Analytics, Communications Eagle Application Processor, Communications Element Manager, Communications Interactive Session Recorder, Communications Operations Monitor, Communications Services Gatekeeper, Communications Session Report Manager, Communications Session Route Manager, Financial Services Regulatory Reporting For De Nederlandsche Bank, Financial Services Revenue Management And Billing Analytics, Health Sciences Inform, Healthcare Translational Research, Hyperion Financial Reporting, Jd Edwards Enterpriseone Orchestrator, Jd Edwards Enterpriseone Tools, Oss Support Tools, Peoplesoft Enterprise Human Capital Management Resources, Primavera Gateway, Rest Data Services, Siebel Mobile, Storagetek Acsls, Storagetek Tape Analytics Sw Tool, Webcenter Sites, Weblogic Server · Netapp: H300s Firmware, H500s Firmware, H700s Firmware, H300e Firmware, H500e Firmware, H700e Firmware, H410s Firmware, H410c Firmware, Active Iq Unified Manager, Cloud Backup, Cloud Insights Storage Workload Security Agent, Hci Baseboard Management Controller, Max Data, Oncommand Insight, Oncommand System Manager, Snap Creator Framework, Snapcenter Server · Tenable: Log Correlation Engine

1 product

1 product

1 product

1 product

30 products

Application Testing Suite

Banking Enterprise Collections

Banking Platform

Blockchain Platform

Business Intelligence

Communications Analytics

Communications Eagle Application Processor

Communications Element Manager

Communications Interactive Session Recorder

Communications Operations Monitor

Communications Services Gatekeeper

Communications Session Report Manager

Communications Session Route Manager

Financial Services Regulatory Reporting For De Nederlandsche Bank

Financial Services Revenue Management And Billing Analytics

Health Sciences Inform

Healthcare Translational Research

Hyperion Financial Reporting

Jd Edwards Enterpriseone Orchestrator

Jd Edwards Enterpriseone Tools

Oss Support Tools

Peoplesoft Enterprise Human Capital Management Resources

Storagetek Tape Analytics Sw Tool

17 products

Active Iq Unified Manager

Cloud Backup

Cloud Insights Storage Workload Security Agent

Hci Baseboard Management Controller

Max Data

Oncommand Insight

Oncommand System Manager

Snap Creator Framework

Snapcenter Server

Tenable

1 product

Log Correlation Engine

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Jquery Jquery	From 1.0.3 to 3.5.0

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 9.0

Configuration C

3 vulnerable

Vulnerable Software	Affected Versions
Fedoraproject Fedora	Version 31
Fedoraproject Fedora	Version 32
Fedoraproject Fedora	Version 33

Configuration D

3 vulnerable

Vulnerable Software	Affected Versions
Drupal Drupal	From 7.0 to 7.70
Drupal Drupal	From 8.7.0 to 8.7.14
Drupal Drupal	From 8.8.0 to 8.8.6

Configuration E

53 vulnerable

Vulnerable Software	Affected Versions
Oracle Application Express	Before 20.2
Oracle Application Testing Suite	Version 13.3.0.1
Oracle Banking Enterprise Collections	From 2.7.0 to 2.8.0
Oracle Banking Platform	From 2.4.0 to 2.10.0
Oracle Blockchain Platform	Before 21.1.2
Oracle Blockchain Platform	Version 21.1.2
Oracle Business Intelligence	Version 5.9.0.0.0
Oracle Communications Analytics	Version 12.1.1
Oracle Communications Eagle Application Processor	From 16.1.0 to 16.4.0
Oracle Communications Element Manager	Version 8.1.1
Oracle Communications Element Manager	Version 8.2.0
Oracle Communications Element Manager	Version 8.2.1
Oracle Communications Interactive Session Recorder	From 6.1 to 6.4
Oracle Communications Operations Monitor	From 4.1 to 4.3
Oracle Communications Operations Monitor	Version 3.4
Oracle Communications Services Gatekeeper	Version 7.0
Oracle Communications Session Report Manager	Version 8.1.1
Oracle Communications Session Report Manager	Version 8.2.0
Oracle Communications Session Report Manager	Version 8.2.1
Oracle Communications Session Route Manager	Version 8.1.1
Oracle Communications Session Route Manager	Version 8.2.0
Oracle Communications Session Route Manager	Version 8.2.1
Oracle Financial Services Regulatory Reporting For De Nederlandsche Bank	Version 8.0.4
Oracle Financial Services Revenue Management And Billing Analytics	Version 2.7
Oracle Financial Services Revenue Management And Billing Analytics	Version 2.8
Oracle Health Sciences Inform	Version 6.3.0
Oracle Healthcare Translational Research	Version 3.2.1
Oracle Healthcare Translational Research	Version 3.3.1
Oracle Healthcare Translational Research	Version 3.3.2
Oracle Healthcare Translational Research	Version 3.4.0
Oracle Hyperion Financial Reporting	Version 11.1.2.4
Oracle Jd Edwards Enterpriseone Orchestrator	Before 9.2.5.0
Oracle Jd Edwards Enterpriseone Tools	Before 9.2.5.0
Oracle Oss Support Tools	Before 2.12.41
Oracle Peoplesoft Enterprise Human Capital Management Resources	Version 9.2
Oracle Primavera Gateway	From 16.2 to 16.2.11
Oracle Primavera Gateway	From 17.12.0 to 17.12.7
Oracle Primavera Gateway	From 18.8.0 to 18.8.9
Oracle Primavera Gateway	From 19.12.0 to 19.12.4
Oracle Rest Data Services	Version 11.2.0.4
Oracle Rest Data Services	Version 12.1.0.2
Oracle Rest Data Services	Version 12.2.0.1
Oracle Rest Data Services	Version 18c
Oracle Rest Data Services	Version 19c
Oracle Siebel Mobile	Up to 20.12
Oracle Storagetek Acsls	Version 8.5.1
Oracle Storagetek Tape Analytics Sw Tool	Version 2.3.1
Oracle Webcenter Sites	Version 12.2.1.3.0
Oracle Webcenter Sites	Version 12.2.1.4.0
Oracle Weblogic Server	Version 12.1.3.0.0
Oracle Weblogic Server	Version 12.2.1.3.0
Oracle Weblogic Server	Version 12.2.1.4.0
Oracle Weblogic Server	Version 14.1.1.0.0

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp H300s Firmware	All versions

Running on/with	Platform Versions
Netapp H300s	All versions

Configuration G

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp H500s Firmware	All versions

Running on/with	Platform Versions
Netapp H500s	All versions

Configuration H

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp H700s Firmware	All versions

Running on/with	Platform Versions
Netapp H700s	All versions

Configuration I

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp H300e Firmware	All versions

Running on/with	Platform Versions
Netapp H300e	All versions

Configuration J

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp H500e Firmware	All versions

Running on/with	Platform Versions
Netapp H500e	All versions

Configuration K

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp H700e Firmware	All versions

Running on/with	Platform Versions
Netapp H700e	All versions

Configuration L

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp H410s Firmware	All versions

Running on/with	Platform Versions
Netapp H410s	All versions

Configuration M

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp H410c Firmware	All versions

Running on/with	Platform Versions
Netapp H410c	All versions

Configuration N

11 vulnerable

Vulnerable Software	Affected Versions
Netapp Active Iq Unified Manager	All versions
Netapp Active Iq Unified Manager	All versions
Netapp Active Iq Unified Manager	All versions
Netapp Cloud Backup	All versions
Netapp Cloud Insights Storage Workload Security Agent	All versions
Netapp Hci Baseboard Management Controller	All versions
Netapp Max Data	All versions
Netapp Oncommand Insight	All versions
Netapp Oncommand System Manager	From 3.0 to 3.1.3
Netapp Snap Creator Framework	All versions
Netapp Snapcenter Server	All versions

Configuration O

1 vulnerable

Vulnerable Software	Affected Versions
Tenable Log Correlation Engine	Before 6.0.9

Related CWEs

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (132)

http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00067.html

Source: security-advisories@github.com

Broken Link

http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00085.html

Source: security-advisories@github.com

Broken Link

http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00039.html

Source: security-advisories@github.com

Broken LinkMailing ListThird Party Advisory

http://packetstormsecurity.com/files/162160/jQuery-1.0.3-Cross-Site-Scripting.html

Source: security-advisories@github.com

ExploitThird Party AdvisoryVDB Entry

https://blog.jquery.com/2020/04/10/jquery-3-5-0-released

Source: security-advisories@github.com

Release NotesVendor Advisory

https://github.com/jquery/jquery/security/advisories/GHSA-jpcq-cgw6-v4j6

Source: security-advisories@github.com

Third Party Advisory

https://jquery.com/upgrade-guide/3.5/

Source: security-advisories@github.com

Release NotesVendor Advisory

https://lists.apache.org/thread.html/r0483ba0072783c2e1bfea613984bfb3c86e73ba8879d780dc1cc7d36%40%3Cissues.flink.apache.org%3E

Source: security-advisories@github.com

Issue TrackingMailing List

https://lists.apache.org/thread.html/r0593393ca1e97b1e7e098fe69d414d6bd0a467148e9138d07e86ebbb%40%3Cissues.hive.apache.org%3E

Source: security-advisories@github.com

Issue TrackingMailing List

https://lists.apache.org/thread.html/r07ab379471fb15644bf7a92e4a98cbc7df3cf4e736abae0cc7625fe6%40%3Cdev.felix.apache.org%3E

Source: security-advisories@github.com

Issue TrackingMailing List

https://lists.apache.org/thread.html/r094f435595582f6b5b24b66fedf80543aa8b1d57a3688fbcc21f06ec%40%3Cissues.hive.apache.org%3E

Source: security-advisories@github.com

Issue TrackingMailing List

https://lists.apache.org/thread.html/r1fed19c860a0d470f2a3eded12795772c8651ff583ef951ddac4918c%40%3Cgitbox.hive.apache.org%3E

Source: security-advisories@github.com

Issue TrackingMailing List

https://lists.apache.org/thread.html/r2c85121a47442036c7f8353a3724aa04f8ecdfda1819d311ba4f5330%40%3Cdev.felix.apache.org%3E

Source: security-advisories@github.com

Issue TrackingMailing List

https://lists.apache.org/thread.html/r3702ede0ff83a29ba3eb418f6f11c473d6e3736baba981a8dbd9c9ef%40%3Cdev.felix.apache.org%3E

Source: security-advisories@github.com

Issue TrackingMailing List

https://lists.apache.org/thread.html/r49ce4243b4738dd763caeb27fa8ad6afb426ae3e8c011ff00b8b1f48%40%3Cissues.flink.apache.org%3E

Source: security-advisories@github.com

Issue TrackingMailing List

https://lists.apache.org/thread.html/r4aadb98086ca72ed75391f54167522d91489a0d0ae25b12baa8fc7c5%40%3Cissues.hive.apache.org%3E

Source: security-advisories@github.com

Issue TrackingMailing List

https://lists.apache.org/thread.html/r4dba67be3239b34861f1b9cfdf9dfb3a90272585dcce374112ed6e16%40%3Cdev.felix.apache.org%3E

Source: security-advisories@github.com

Issue TrackingMailing List

https://lists.apache.org/thread.html/r54565a8f025c7c4f305355fdfd75b68eca442eebdb5f31c2e7d977ae%40%3Cissues.flink.apache.org%3E

Source: security-advisories@github.com

Issue TrackingMailing List

https://lists.apache.org/thread.html/r55f5e066cc7301e3630ce90bbbf8d28c82212ae1f2d4871012141494%40%3Cdev.felix.apache.org%3E

Source: security-advisories@github.com

Issue TrackingMailing List

https://lists.apache.org/thread.html/r564585d97bc069137e64f521e68ba490c7c9c5b342df5d73c49a0760%40%3Cissues.flink.apache.org%3E

Source: security-advisories@github.com

Issue TrackingMailing List

https://lists.apache.org/thread.html/r6c4df3b33e625a44471009a172dabe6865faec8d8f21cac2303463b1%40%3Cissues.hive.apache.org%3E

Source: security-advisories@github.com

Issue TrackingMailing List

https://lists.apache.org/thread.html/r6e97b37963926f6059ecc1e417721608723a807a76af41d4e9dbed49%40%3Cissues.hive.apache.org%3E

Source: security-advisories@github.com

Issue TrackingMailing List

https://lists.apache.org/thread.html/r706cfbc098420f7113968cc377247ec3d1439bce42e679c11c609e2d%40%3Cissues.flink.apache.org%3E

Source: security-advisories@github.com

Issue TrackingMailing List

https://lists.apache.org/thread.html/r8f70b0f65d6bedf316ecd899371fd89e65333bc988f6326d2956735c%40%3Cissues.flink.apache.org%3E

Source: security-advisories@github.com

Issue TrackingMailing List

https://lists.apache.org/thread.html/r9006ad2abf81d02a0ef2126bab5177987e59095b7194a487c4ea247c%40%3Ccommits.felix.apache.org%3E

Source: security-advisories@github.com

Issue TrackingMailing List

https://lists.apache.org/thread.html/r9c5fda81e4bca8daee305b4c03283dddb383ab8428a151d4cb0b3b15%40%3Cissues.hive.apache.org%3E

Source: security-advisories@github.com

Issue TrackingMailing List

https://lists.apache.org/thread.html/r9e0bd31b7da9e7403478d22652b8760c946861f8ebd7bd750844898e%40%3Cdev.felix.apache.org%3E

Source: security-advisories@github.com

Issue TrackingMailing List

https://lists.apache.org/thread.html/ra32c7103ded9041c7c1cb8c12c8d125a6b2f3f3270e2937ef8417fac%40%3Cgitbox.hive.apache.org%3E

Source: security-advisories@github.com

Issue TrackingMailing List

https://lists.apache.org/thread.html/ra374bb0299b4aa3e04edde01ebc03ed6f90cf614dad40dd428ce8f72%40%3Cgitbox.hive.apache.org%3E

Source: security-advisories@github.com

Issue TrackingMailing List

https://lists.apache.org/thread.html/ra3c9219fcb0b289e18e9ec5a5ebeaa5c17d6b79a201667675af6721c%40%3Cgitbox.hive.apache.org%3E

Source: security-advisories@github.com

Issue TrackingMailing List

https://lists.apache.org/thread.html/ra406b3adfcffcb5ce8707013bdb7c35e3ffc2776a8a99022f15274c6%40%3Cissues.hive.apache.org%3E

Source: security-advisories@github.com

Issue TrackingMailing List

https://lists.apache.org/thread.html/rab82dd040f302018c85bd07d33f5604113573514895ada523c3401d9%40%3Ccommits.hive.apache.org%3E

Source: security-advisories@github.com

Issue TrackingMailing List

https://lists.apache.org/thread.html/radcb2aa874a79647789f3563fcbbceaf1045a029ee8806b59812a8ea%40%3Cissues.hive.apache.org%3E

Source: security-advisories@github.com

Issue TrackingMailing List

https://lists.apache.org/thread.html/rb25c3bc7418ae75cba07988dafe1b6912f76a9dd7d94757878320d61%40%3Cgitbox.hive.apache.org%3E

Source: security-advisories@github.com

Issue TrackingMailing List

https://lists.apache.org/thread.html/rb69b7d8217c1a6a2100247a5d06ce610836b31e3f5d73fc113ded8e7%40%3Cissues.hive.apache.org%3E

Source: security-advisories@github.com

Issue TrackingMailing List

https://lists.apache.org/thread.html/rbb448222ba62c430e21e13f940be4cb5cfc373cd3bce56b48c0ffa67%40%3Cdev.flink.apache.org%3E

Source: security-advisories@github.com

Issue TrackingMailing List

https://lists.apache.org/thread.html/rd38b4185a797b324c8dd940d9213cf99fcdc2dbf1fc5a63ba7dee8c9%40%3Cissues.hive.apache.org%3E

Source: security-advisories@github.com

Issue TrackingMailing List

https://lists.apache.org/thread.html/rda99599896c3667f2cc9e9d34c7b6ef5d2bbed1f4801e1d75a2b0679%40%3Ccommits.nifi.apache.org%3E

Source: security-advisories@github.com

Issue TrackingMailing List

https://lists.apache.org/thread.html/re4ae96fa5c1a2fe71ccbb7b7ac1538bd0cb677be270a2bf6e2f8d108%40%3Cissues.flink.apache.org%3E

Source: security-advisories@github.com

Issue TrackingMailing List

https://lists.apache.org/thread.html/rede9cfaa756e050a3d83045008f84a62802fc68c17f2b4eabeaae5e4%40%3Cissues.flink.apache.org%3E

Source: security-advisories@github.com

Issue TrackingMailing List

https://lists.apache.org/thread.html/ree3bd8ddb23df5fa4e372d11c226830ea3650056b1059f3965b3fce2%40%3Cissues.flink.apache.org%3E

Source: security-advisories@github.com

Issue TrackingMailing List

https://lists.apache.org/thread.html/rf0f8939596081d84be1ae6a91d6248b96a02d8388898c372ac807817%40%3Cdev.felix.apache.org%3E

Source: security-advisories@github.com

Issue TrackingMailing List

https://lists.apache.org/thread.html/rf1ba79e564fe7efc56aef7c986106f1cf67a3427d08e997e088e7a93%40%3Cgitbox.hive.apache.org%3E

Source: security-advisories@github.com

Issue TrackingMailing List

https://lists.apache.org/thread.html/rf661a90a15da8da5922ba6127b3f5f8194d4ebec8855d60a0dd13248%40%3Cdev.hive.apache.org%3E

Source: security-advisories@github.com

Issue TrackingMailing List

https://lists.debian.org/debian-lts-announce/2021/03/msg00033.html

Source: security-advisories@github.com

Mailing ListThird Party Advisory

https://lists.debian.org/debian-lts-announce/2023/08/msg00040.html

Source: security-advisories@github.com

Mailing ListThird Party Advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AVKYXLWCLZBV2N7M46KYK4LVA5OXWPBY/

Source: security-advisories@github.com

Mailing ListThird Party Advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QPN2L2XVQGUA2V5HNQJWHK3APSK3VN7K/

Source: security-advisories@github.com

Mailing ListThird Party Advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SAPQVX3XDNPGFT26QAQ6AJIXZZBZ4CD4/

Source: security-advisories@github.com

Mailing ListThird Party Advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SFP4UK4EGP4AFH2MWYJ5A5Z4I7XVFQ6B/

Source: security-advisories@github.com

Mailing ListThird Party Advisory

https://security.gentoo.org/glsa/202007-03

Source: security-advisories@github.com

Third Party Advisory

https://security.netapp.com/advisory/ntap-20200511-0006/

Source: security-advisories@github.com

Third Party Advisory

https://www.debian.org/security/2020/dsa-4693

Source: security-advisories@github.com

Mailing ListThird Party Advisory

https://www.drupal.org/sa-core-2020-002

Source: security-advisories@github.com

Third Party Advisory

https://www.oracle.com//security-alerts/cpujul2021.html

Source: security-advisories@github.com

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpuApr2021.html

Source: security-advisories@github.com

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpuapr2022.html

Source: security-advisories@github.com

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpujan2021.html

Source: security-advisories@github.com

Third Party Advisory

https://www.oracle.com/security-alerts/cpujan2022.html

Source: security-advisories@github.com

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpujul2020.html

Source: security-advisories@github.com

Third Party Advisory

https://www.oracle.com/security-alerts/cpujul2022.html

Source: security-advisories@github.com

Third Party Advisory

https://www.oracle.com/security-alerts/cpuoct2020.html

Source: security-advisories@github.com

Third Party Advisory

https://www.oracle.com/security-alerts/cpuoct2021.html

Source: security-advisories@github.com

PatchThird Party Advisory

https://www.tenable.com/security/tns-2021-02

Source: security-advisories@github.com

Third Party Advisory

https://www.tenable.com/security/tns-2021-10

Source: security-advisories@github.com

Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00067.html