NetSight
IP …
medium6.9Public exploit code

CVE-2020-11022

Potential XSS vulnerability in jQuery

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Impact

### Impact Passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. `.html()`, `.append()`, and others) may execute untrusted code. ### Patches This problem is patched in jQuery 3.5.0. ### Workarounds To workaround the issue without upgrading, adding the following to your code: ```js jQuery.htmlPrefilter = function( html ) { return html; }; ``` You need to use at least jQuery 1.12/2.2 or newer to be able to apply this workaround. ### References https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/ https://jquery.com/upgrade-guide/3.5/ ### For more information If you have any questions or comments about this advisory, search for a relevant issue in [the jQuery repo](https://github.com/jquery/jquery/issues). If you don't find an answer, open a new issue.

Affected packages

EcosystemPackageAffectedFixed in
rubygemsjquery-rails< 4.4.04.4.0
composermaximebf/debugbar< 1.19.01.19.0
composerathlon1600/youtube-downloader<= 4.0.04.0.1
npmjquery>= 1.12.0, < 3.5.03.5.0
nugetjquery>= 1.12.0, < 3.5.03.5.0
mavenorg.webjars.npm:jquery>= 1.12.0, < 3.5.03.5.0
composercomponents/jquery>= 1.12.0, < 3.5.03.5.0

Affected products

VendorProductAffected versions
JqueryJquery
from 1.2 before 3.5.0
DrupalDrupal
from 7.0 before 7.70
from 8.7.0 before 8.7.14
from 8.8.0 before 8.8.6
DebianDebian Linux
Version 9.0
FedoraprojectFedora
Versions 31, 32, 33
OracleAgile Product Lifecycle Management For Process
Version 6.2.0.0
OracleApplication Testing Suite
Version 13.3.0.1
OracleBanking Digital Experience
Versions 18.1, 18.2, 18.3, 19.1, 19.2, 20.1
OracleBlockchain Platform
before 21.1.2
OracleCommunications Application Session Controller
Version 3.8m0
OracleCommunications Billing And Revenue Management
Versions 7.5.0.23.0, 12.0.0.3.0
OracleCommunications Diameter Signaling Router Idih\
from 8.0.0 through 8.2.2
OracleCommunications Eagle Application Processor
from 16.1.0 through 16.4.0

Weakness classification

CWE-79

References