What’s Vulnerable › Vulnerabilities
CVE-2020-11022: jQuery has a potential XSS vulnerability
- Severity: medium (CVSS 6.1 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 99.2% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2020-04-29 · updated 2026-06-17
- Weakness: CWE-79
Description
In jQuery starting with 1.12.0 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.
Affected products
- Debian Linux: 9.0
- Drupal: from 7.0 before 7.70; from 8.7.0 before 8.7.14; from 8.8.0 before 8.8.6 — fixed in 7.70, 8.7.14, 8.8.6
- Fedoraproject Fedora: 31, 32, 33
- jQuery: from 1.2 before 3.5.0 — fixed in 3.5.0
- NetApp H300E Firmware: all versions
- NetApp H300S Firmware: all versions
- NetApp H410C Firmware: all versions
- NetApp H410S Firmware: all versions
- NetApp H500E Firmware: all versions
- NetApp H500S Firmware: all versions
- NetApp H700E Firmware: all versions
- NetApp H700S Firmware: all versions
- NetApp Max Data: all versions
- OnCommand Insight: all versions
- OnCommand System Manager 9.x: from 3.0 through 3.1.3
- NetApp Snap Creator Framework: all versions
- NetApp SnapCenter: all versions
- openSUSE Leap: 15.1, 15.2
- Oracle Corporation Oracle Agile Product Lifecycle Management for Process: 6.2.0.0
- Oracle Agile Product Supplier Collaboration For Process: 6.2.0.0
- Oracle Corporation Oracle Application Testing Suite: 13.3.0.1
- Oracle Corporation Banking Digital Experience: from 18.1 through 20.1; 18.1, 18.2, 18.3, 19.1, 19.2, 20.1
- Oracle Blockchain Platform: before 21.1.2 — fixed in 21.1.2
- Oracle Communications Application Session Controller: 3.8m0
- Oracle Corporation Communications Billing and Revenue Management: 7.5.0.23.0, 12.0.0.3.0
- Oracle Communications Diameter Signaling Router Idih:: from 8.0.0 through 8.2.2
- Oracle Communications Eagle Application Processor: from 16.1.0 through 16.4.0
- Oracle Communications Services Gatekeeper: 7.0
- Oracle Corporation Communications WebRTC Session Controller: 7.2
- Oracle Corporation Enterprise Manager Ops Center: 12.4.0.0
How to fix
Upgrade to a fixed version: Drupal 7.70, 8.7.14, 8.8.6; jQuery 3.5.0; Oracle Blockchain Platform 21.1.2. Check the vendor advisory for mitigations.
References
- http://security.netapp.com/advisory/ntap-20200511-0006
- https://blog.jquery.com/2020/04/10/jquery-3-5-0-released
- https://github.com/jquery/jquery/commit/1d61fd9407e6fbe82fe55cb0b938307aa0791f77
- https://github.com/jquery/jquery/releases/tag/3.5.0
- https://github.com/jquery/jquery/security/advisories/GHSA-gxr4-xjj5-5px2
- https://github.com/maximebf/php-debugbar/commit/847216e60544258c881f2733d699bbcfeefac0fc
- https://github.com/maximebf/php-debugbar/issues/447
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/jquery-rails/CVE-2020-11022.yml
- https://jquery.com/upgrade-guide/3.5
- https://lists.apache.org/thread.html/r0483ba0072783c2e1bfea613984bfb3c86e73ba8879d780dc1cc7d36@%3Cissues.flink.apache.org%3E
- https://lists.apache.org/thread.html/r49ce4243b4738dd763caeb27fa8ad6afb426ae3e8c011ff00b8b1f48@%3Cissues.flink.apache.org%3E
- https://lists.apache.org/thread.html/r54565a8f025c7c4f305355fdfd75b68eca442eebdb5f31c2e7d977ae@%3Cissues.flink.apache.org%3E
Get alerted when CVE-2020-11022 or the next vulnerability affects your stack