NetSight
IP …
medium6.9Known exploitedPublic exploit code

CVE-2020-11023

JQuery Cross-Site Scripting (XSS) Vulnerability

Exploited in the wild

This vulnerability is on a Known Exploited Vulnerabilities catalogue, added 2025-01-23. Federal due date: 2025-02-13.

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Impact

In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.

Affected products

VendorProductAffected versions
JqueryJquery
from 1.0.3 before 3.5.0
DebianDebian Linux
Version 9.0
FedoraprojectFedora
Versions 31, 32, 33
DrupalDrupal
from 7.0 before 7.70
from 8.7.0 before 8.7.14
from 8.8.0 before 8.8.6
OracleApplication Express
before 20.2
OracleApplication Testing Suite
Version 13.3.0.1
OracleBanking Enterprise Collections
from 2.7.0 through 2.8.0
OracleBanking Platform
from 2.4.0 through 2.10.0
OracleBlockchain Platform
before 21.1.2
Version 21.1.2
OracleBusiness Intelligence
Version 5.9.0.0.0
OracleCommunications Analytics
Version 12.1.1
OracleCommunications Eagle Application Processor
from 16.1.0 through 16.4.0

Weakness classification

CWE-79

References