rewindex

RewindexCVEs

CVE-2020-11023: Potential XSS vulnerability in jQuery

Medium · CVSS 6.9 (CVSS 3.1)KEV known exploitedEPSS 84.9%, 100th percentilePublished Updated Assigner: GitHub_M

In CISA’s Known Exploited Vulnerabilities catalog: JQuery Cross-Site Scripting (XSS) Vulnerability.

Added , federal remediation due . Known ransomware use: Unknown.

Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Description

In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.

Vector CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N · CWE-79

Status incidents that name it

No tracked status incident names this CVE.

Affected vendors and products

jquery: jQuery

References

All CVEsMarkdownJSON