CVE-2020-11023
MEDIUMCVSS 6.1/10Actively ExploitedEPSS 83.83%
Last modified
CVE-2020-11023 is a medium-severity vulnerability rated 6.1/10 on the CVSS scale. In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. CISA has confirmed active exploitation in the wild. EPSS estimates a 83.83% chance of exploitation in the next 30 days.
Description
In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Exploitation Status
This vulnerability is listed in CISA’s Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. Federal agencies must remediate by .
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Jquery | Jquery | >= 1.0.3, < 3.5.0 |
| Debian | Debian Linux | 9.0 |
| Fedoraproject | Fedora | 31 |
| Fedoraproject | Fedora | 32 |
| Fedoraproject | Fedora | 33 |
| Drupal | Drupal | >= 7.0, < 7.70 |
| Drupal | Drupal | >= 8.7.0, < 8.7.14 |
| Drupal | Drupal | >= 8.8.0, < 8.8.6 |
| Oracle | Application Express | < 20.2 |
| Oracle | Application Testing Suite | 13.3.0.1 |
| Oracle | Banking Enterprise Collections | >= 2.7.0, <= 2.8.0 |
| Oracle | Banking Platform | >= 2.4.0, <= 2.10.0 |
| Oracle | Blockchain Platform | < 21.1.2 |
| Oracle | Blockchain Platform | 21.1.2 |
| Oracle | Business Intelligence | 5.9.0.0.0 |
| Oracle | Communications Analytics | 12.1.1 |
| Oracle | Communications Eagle Application Processor | >= 16.1.0, <= 16.4.0 |
| Oracle | Communications Element Manager | 8.1.1 |
| Oracle | Communications Element Manager | 8.2.0 |
| Oracle | Communications Element Manager | 8.2.1 |
| Oracle | Communications Interactive Session Recorder | >= 6.1, <= 6.4 |
| Oracle | Communications Operations Monitor | >= 4.1, <= 4.3 |
| Oracle | Communications Operations Monitor | 3.4 |
| Oracle | Communications Services Gatekeeper | 7.0 |
| Oracle | Communications Session Report Manager | 8.1.1 |
| Oracle | Communications Session Report Manager | 8.2.0 |
| Oracle | Communications Session Report Manager | 8.2.1 |
| Oracle | Communications Session Route Manager | 8.1.1 |
| Oracle | Communications Session Route Manager | 8.2.0 |
| Oracle | Communications Session Route Manager | 8.2.1 |
| Oracle | Financial Services Regulatory Reporting For De Nederlandsche Bank | 8.0.4 |
| Oracle | Financial Services Revenue Management And Billing Analytics | 2.7 |
| Oracle | Financial Services Revenue Management And Billing Analytics | 2.8 |
| Oracle | Health Sciences Inform | 6.3.0 |
| Oracle | Healthcare Translational Research | 3.2.1 |
| Oracle | Healthcare Translational Research | 3.3.1 |
| Oracle | Healthcare Translational Research | 3.3.2 |
| Oracle | Healthcare Translational Research | 3.4.0 |
| Oracle | Hyperion Financial Reporting | 11.1.2.4 |
| Oracle | Jd Edwards Enterpriseone Orchestrator | < 9.2.5.0 |
| Oracle | Jd Edwards Enterpriseone Tools | < 9.2.5.0 |
| Oracle | Oss Support Tools | < 2.12.41 |
| Oracle | Peoplesoft Enterprise Human Capital Management Resources | 9.2 |
| Oracle | Primavera Gateway | >= 16.2, <= 16.2.11 |
| Oracle | Primavera Gateway | >= 17.12.0, <= 17.12.7 |
| Oracle | Primavera Gateway | >= 18.8.0, <= 18.8.9 |
| Oracle | Primavera Gateway | >= 19.12.0, <= 19.12.4 |
| Oracle | Rest Data Services | 11.2.0.4 |
| Oracle | Rest Data Services | 12.1.0.2 |
| Oracle | Rest Data Services | 12.2.0.1 |
Showing 50 of 79 affected configurations. See NVD for the full list.
References
- http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00039.htmlBroken Link, Mailing List, Third Party Advisory
- http://packetstormsecurity.com/files/162160/jQuery-1.0.3-Cross-Site-Scripting.htmlExploit, Third Party Advisory, VDB Entry
- https://blog.jquery.com/2020/04/10/jquery-3-5-0-releasedRelease Notes, Vendor Advisory
- https://github.com/jquery/jquery/security/advisories/GHSA-jpcq-cgw6-v4j6Third Party Advisory
- https://jquery.com/upgrade-guide/3.5/Release Notes, Vendor Advisory
- https://lists.debian.org/debian-lts-announce/2021/03/msg00033.htmlMailing List, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2023/08/msg00040.htmlMailing List, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AVKYXLWCLZBV2N7M46KYK4LVA5OXWPBY/Mailing List, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QPN2L2XVQGUA2V5HNQJWHK3APSK3VN7K/Mailing List, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SAPQVX3XDNPGFT26QAQ6AJIXZZBZ4CD4/Mailing List, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SFP4UK4EGP4AFH2MWYJ5A5Z4I7XVFQ6B/Mailing List, Third Party Advisory
- https://security.gentoo.org/glsa/202007-03Third Party Advisory
- https://security.netapp.com/advisory/ntap-20200511-0006/Third Party Advisory
- https://www.debian.org/security/2020/dsa-4693Mailing List, Third Party Advisory
- https://www.drupal.org/sa-core-2020-002Third Party Advisory
- https://www.oracle.com//security-alerts/cpujul2021.htmlPatch, Third Party Advisory
- https://www.oracle.com/security-alerts/cpuApr2021.htmlPatch, Third Party Advisory
- https://www.oracle.com/security-alerts/cpuapr2022.htmlPatch, Third Party Advisory
- https://www.oracle.com/security-alerts/cpujan2021.htmlThird Party Advisory
- https://www.oracle.com/security-alerts/cpujan2022.htmlPatch, Third Party Advisory
- https://www.oracle.com/security-alerts/cpujul2020.htmlThird Party Advisory
- https://www.oracle.com/security-alerts/cpujul2022.htmlThird Party Advisory
- https://www.oracle.com/security-alerts/cpuoct2020.htmlThird Party Advisory
- https://www.oracle.com/security-alerts/cpuoct2021.htmlPatch, Third Party Advisory
- https://www.tenable.com/security/tns-2021-02Third Party Advisory
- https://www.tenable.com/security/tns-2021-10Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00039.htmlBroken Link, Mailing List, Third Party Advisory
- http://packetstormsecurity.com/files/162160/jQuery-1.0.3-Cross-Site-Scripting.htmlExploit, Third Party Advisory, VDB Entry
- https://blog.jquery.com/2020/04/10/jquery-3-5-0-releasedRelease Notes, Vendor Advisory
- https://github.com/jquery/jquery/security/advisories/GHSA-jpcq-cgw6-v4j6Third Party Advisory
- https://jquery.com/upgrade-guide/3.5/Release Notes, Vendor Advisory
- https://lists.debian.org/debian-lts-announce/2021/03/msg00033.htmlMailing List, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2023/08/msg00040.htmlMailing List, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AVKYXLWCLZBV2N7M46KYK4LVA5OXWPBY/Mailing List, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QPN2L2XVQGUA2V5HNQJWHK3APSK3VN7K/Mailing List, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SAPQVX3XDNPGFT26QAQ6AJIXZZBZ4CD4/Mailing List, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SFP4UK4EGP4AFH2MWYJ5A5Z4I7XVFQ6B/Mailing List, Third Party Advisory
- https://security.gentoo.org/glsa/202007-03Third Party Advisory
- https://security.netapp.com/advisory/ntap-20200511-0006/Third Party Advisory
- https://www.debian.org/security/2020/dsa-4693Mailing List, Third Party Advisory
- https://www.drupal.org/sa-core-2020-002Third Party Advisory
- https://www.oracle.com//security-alerts/cpujul2021.htmlPatch, Third Party Advisory
- https://www.oracle.com/security-alerts/cpuApr2021.htmlPatch, Third Party Advisory
- https://www.oracle.com/security-alerts/cpuapr2022.htmlPatch, Third Party Advisory
- https://www.oracle.com/security-alerts/cpujan2021.htmlThird Party Advisory
- https://www.oracle.com/security-alerts/cpujan2022.htmlPatch, Third Party Advisory
- https://www.oracle.com/security-alerts/cpujul2020.htmlThird Party Advisory
- https://www.oracle.com/security-alerts/cpujul2022.htmlThird Party Advisory
- https://www.oracle.com/security-alerts/cpuoct2020.htmlThird Party Advisory
- https://www.oracle.com/security-alerts/cpuoct2021.htmlPatch, Third Party Advisory
- https://www.tenable.com/security/tns-2021-02Third Party Advisory
- https://www.tenable.com/security/tns-2021-10Third Party Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-11023US Government Resource
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2020-11023?
In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.
How severe is CVE-2020-11023?
CVE-2020-11023 has a CVSS score of 6.1/10 (MEDIUM severity). The EPSS model estimates a 83.83% probability of exploitation in the next 30 days. This vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog.
How do I fix CVE-2020-11023?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
Are you affected by CVE-2020-11023?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST