Vulnerability · Published Apr 29, 2020 · Assigned by GitHub_M

CVE-2020-11022jQuery has a potential XSS vulnerability

Medium 6.9

In plain English

A medium-severity cross-site scripting in jQuery from jquery. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 99.2% (higher than 99.9% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.9Medium

Exploit odds (30 days)99.2%top 0.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling1Public PoC

Official description

In jQuery starting with 1.12.0 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
AlmaLinux:8	custodia	0.6.0-3.module_el8.6.0+2881+2f24dc92	ALSA-2020:4670
AlmaLinux:8	python3-custodia	0.6.0-3.module_el8.6.0+2881+2f24dc92	ALSA-2020:4670
AlmaLinux:8	python3-jwcrypto	0.5.0-1.module_el8.5.0+2641+983b221b	ALSA-2020:4670
AlmaLinux:8	python3-jwcrypto	0.5.0-1.module_el8.6.0+2881+2f24dc92	ALSA-2020:4670
AlmaLinux:8	python3-jwcrypto	0.5.0-1.module_el8.6.0+2737+7e73ea90	ALSA-2020:4670
AlmaLinux:8	python3-kdcproxy	0.4-5.module_el8.6.0+2881+2f24dc92	ALSA-2020:4670
AlmaLinux:8	python3-pyusb	1.0.0-9.module_el8.5.0+2641+983b221b	ALSA-2020:4670
AlmaLinux:8	python3-pyusb	1.0.0-9.module_el8.6.0+2881+2f24dc92	ALSA-2020:4670
AlmaLinux:8	python3-pyusb	1.0.0-9.module_el8.6.0+2737+7e73ea90	ALSA-2020:4670
AlmaLinux:8	python3-qrcode	5.1-12.module_el8.6.0+2881+2f24dc92	ALSA-2020:4670
AlmaLinux:8	python3-qrcode	5.1-12.module_el8.5.0+2641+983b221b	ALSA-2020:4670
AlmaLinux:8	python3-qrcode	5.1-12.module_el8.6.0+2737+7e73ea90	ALSA-2020:4670
AlmaLinux:8	python3-qrcode-core	5.1-12.module_el8.6.0+2737+7e73ea90	ALSA-2020:4670
AlmaLinux:8	python3-qrcode-core	5.1-12.module_el8.6.0+2881+2f24dc92	ALSA-2020:4670
AlmaLinux:8	python3-qrcode-core	5.1-12.module_el8.5.0+2641+983b221b	ALSA-2020:4670
AlmaLinux:8	python3-yubico	1.3.2-9.module_el8.5.0+2641+983b221b	ALSA-2020:4670
AlmaLinux:8	python3-yubico	1.3.2-9.module_el8.6.0+2737+7e73ea90	ALSA-2020:4670
AlmaLinux:8	python3-yubico	1.3.2-9.module_el8.6.0+2881+2f24dc92	ALSA-2020:4670
Alpine:v3.20	cacti	1.2.13-r0	ALPINE-CVE-2020-11022
Alpine:v3.21	cacti	1.2.13-r0	ALPINE-CVE-2020-11022
Alpine:v3.22	cacti	1.2.13-r0	ALPINE-CVE-2020-11022
Alpine:v3.23	cacti	1.2.13-r0	ALPINE-CVE-2020-11022
Alpine:v3.24	cacti	1.2.13-r0	ALPINE-CVE-2020-11022
Alpine:v3.20	drupal7	7.70-r0	ALPINE-CVE-2020-11022
Debian:12	node-jquery	3.5.0+dfsg-2	DEBIAN-CVE-2020-11022
Debian:13	node-jquery	3.5.0+dfsg-2	DEBIAN-CVE-2020-11022
Debian:14	node-jquery	3.5.0+dfsg-2	DEBIAN-CVE-2020-11022
Debian:12	znc	no fix listed	DEBIAN-CVE-2020-11022
Debian:13	znc	no fix listed	DEBIAN-CVE-2020-11022
Debian:14	znc	1.10.3-1	DEBIAN-CVE-2020-11022
Maven	org.webjars.npm:jquery	3.5.0	GHSA-gxr4-xjj5-5px2
NuGet	jquery	3.5.0	GHSA-gxr4-xjj5-5px2
Packagist	athlon1600/youtube-downloader	4.0.1	GHSA-gxr4-xjj5-5px2
Packagist	components/jquery	3.5.0	GHSA-gxr4-xjj5-5px2
Packagist	maximebf/debugbar	1.19.0	GHSA-gxr4-xjj5-5px2
Rocky Linux:8	apache-commons-collections	0:3.2.2-10.module+el8.3.0+53+ea062990	RLSA-2020:4847
Rocky Linux:8	apache-commons-collections	0:3.2.2-10.module+el8.3.0+74+855e3f5d	RLSA-2020:4847
Rocky Linux:8	apache-commons-lang	0:2.6-21.module+el8.3.0+53+ea062990	RLSA-2020:4847
Rocky Linux:8	apache-commons-lang	0:2.6-21.module+el8.3.0+74+855e3f5d	RLSA-2020:4847
Rocky Linux:8	apache-commons-net	0:3.6-3.module+el8.3.0+53+ea062990	RLSA-2020:4847
Rocky Linux:8	apache-commons-net	0:3.6-3.module+el8.3.0+74+855e3f5d	RLSA-2020:4847
Rocky Linux:8	bea-stax	0:1.2.0-16.module+el8.3.0+53+ea062990	RLSA-2020:4847
Rocky Linux:8	custodia	0:0.6.0-3.module+el8.4.0+429+6bd33fea	RLSA-2020:4670
Rocky Linux:8	glassfish-fastinfoset	0:1.2.13-9.module+el8.3.0+53+ea062990	RLSA-2020:4847
Rocky Linux:8	glassfish-jaxb	0:2.2.11-11.module+el8.3.0+53+ea062990	RLSA-2020:4847
Rocky Linux:8	glassfish-jaxb-api	0:2.2.12-8.module+el8.3.0+53+ea062990	RLSA-2020:4847
Rocky Linux:8	jackson-annotations	0:2.10.0-1.module+el8.3.0+53+ea062990	RLSA-2020:4847
Rocky Linux:8	jackson-core	0:2.10.0-1.module+el8.3.0+53+ea062990	RLSA-2020:4847
Rocky Linux:8	jackson-databind	0:2.10.0-1.module+el8.3.0+53+ea062990	RLSA-2020:4847
Rocky Linux:8	jackson-jaxrs-providers	0:2.9.9-1.module+el8.3.0+53+ea062990	RLSA-2020:4847
Rocky Linux:8	jackson-module-jaxb-annotations	0:2.7.6-4.module+el8.3.0+53+ea062990	RLSA-2020:4847
Rocky Linux:8	jakarta-commons-httpclient	1:3.1-28.module+el8.3.0+74+855e3f5d	RLSA-2020:4847
Rocky Linux:8	jakarta-commons-httpclient	1:3.1-28.module+el8.3.0+53+ea062990	RLSA-2020:4847
Rocky Linux:8	javassist	0:3.18.1-8.module+el8.3.0+74+855e3f5d	RLSA-2020:4847
Rocky Linux:8	javassist	0:3.18.1-8.module+el8.3.0+53+ea062990	RLSA-2020:4847
Rocky Linux:8	ldapjdk	0:4.22.0-1.module+el8.4.0+418+b7ae1d4a	RLSA-2020:4847
Rocky Linux:8	pki-servlet-engine	1:9.0.30-1.module+el8.3.0+53+ea062990	RLSA-2020:4847
Rocky Linux:8	python-jwcrypto	0:0.5.0-1.1.module+el8.7.0+1074+aae18f3a	RLSA-2020:4670
Rocky Linux:8	python-jwcrypto	0:0.5.0-1.module+el8.4.0+429+6bd33fea	RLSA-2020:4670
Rocky Linux:8	python-kdcproxy	0:0.4-5.module+el8.3.0+244+0b2ae752	RLSA-2020:4670
Rocky Linux:8	python-nss	0:1.0.1-10.module+el8.3.0+53+ea062990	RLSA-2020:4847
Rocky Linux:8	python-qrcode	0:5.1-12.module+el8.4.0+429+6bd33fea	RLSA-2020:4670
Rocky Linux:8	python-yubico	0:1.3.2-9.module+el8.4.0+429+6bd33fea	RLSA-2020:4670
Rocky Linux:8	python-yubico	0:1.3.2-9.1.module+el8.7.0+1074+aae18f3a	RLSA-2020:4670
Rocky Linux:8	pyusb	0:1.0.0-9.module+el8.4.0+429+6bd33fea	RLSA-2020:4670
Rocky Linux:8	pyusb	0:1.0.0-9.1.module+el8.7.0+1074+aae18f3a	RLSA-2020:4670
Rocky Linux:8	relaxngDatatype	0:2011.1-7.module+el8.3.0+53+ea062990	RLSA-2020:4847
Rocky Linux:8	resteasy	0:3.0.26-3.module+el8.3.0+53+ea062990	RLSA-2020:4847
Rocky Linux:8	slf4j	0:1.7.25-4.module+el8.3.0+74+855e3f5d	RLSA-2020:4847
Rocky Linux:8	slf4j	0:1.7.25-4.module+el8.5.0+697+f586bb30	RLSA-2020:4847
Rocky Linux:8	slf4j	0:1.7.25-4.module+el8.3.0+133+b8b54b58	RLSA-2020:4847
Rocky Linux:8	stax-ex	0:1.7.7-8.module+el8.3.0+53+ea062990	RLSA-2020:4847
Rocky Linux:8	velocity	0:1.7-24.module+el8.3.0+74+855e3f5d	RLSA-2020:4847
Rocky Linux:8	velocity	0:1.7-24.module+el8.3.0+53+ea062990	RLSA-2020:4847
Rocky Linux:8	xalan-j2	0:2.7.1-38.module+el8.3.0+53+ea062990	RLSA-2020:4847
Rocky Linux:8	xalan-j2	0:2.7.1-38.module+el8.3.0+74+855e3f5d	RLSA-2020:4847
Rocky Linux:8	xerces-j2	0:2.11.0-34.module+el8.3.0+53+ea062990	RLSA-2020:4847
Rocky Linux:8	xerces-j2	0:2.11.0-34.module+el8.3.0+74+855e3f5d	RLSA-2020:4847
Rocky Linux:8	xml-commons-apis	0:1.4.01-25.module+el8.3.0+53+ea062990	RLSA-2020:4847
Rocky Linux:8	xml-commons-apis	0:1.4.01-25.module+el8.3.0+74+855e3f5d	RLSA-2020:4847
Rocky Linux:8	xml-commons-apis	0:1.4.01-25.module+el8.5.0+697+f586bb30	RLSA-2020:4847
Rocky Linux:8	xml-commons-resolver	0:1.2-26.module+el8.3.0+74+855e3f5d	RLSA-2020:4847
Rocky Linux:8	xml-commons-resolver	0:1.2-26.module+el8.3.0+53+ea062990	RLSA-2020:4847
Rocky Linux:8	xmlstreambuffer	0:1.5.4-8.module+el8.3.0+53+ea062990	RLSA-2020:4847
Rocky Linux:8	xsom	0:0-19.20110809svn.module+el8.3.0+53+ea062990	RLSA-2020:4847
RubyGems	jquery-rails	4.4.0	GHSA-gxr4-xjj5-5px2
npm	jquery	3.5.0	GHSA-gxr4-xjj5-5px2

Affected products (as reported)

Vendor	Product	Versions
jquery	jQuery	>= 1.12.0, < 3.5.0

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N

References

https://github.com/jquery/jquery/security/advisories/GHSA-gxr4-xjj5-5px2 x_refsource_CONFIRM
https://github.com/maximebf/php-debugbar/issues/447 x_refsource_MISC
https://github.com/jquery/jquery/commit/1d61fd9407e6fbe82fe55cb0b938307aa0791f77 x_refsource_MISC
https://github.com/maximebf/php-debugbar/commit/847216e60544258c881f2733d699bbcfeefac0fc x_refsource_MISC
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VOE7P7APPRQKD4FGNHBKJPDY6FFCOH3W x_refsource_MISC
https://lists.opensuse.org/opensuse-security-announce/2020-07/msg00067.html x_refsource_MISC
https://lists.opensuse.org/opensuse-security-announce/2020-07/msg00085.html x_refsource_MISC
https://lists.opensuse.org/opensuse-security-announce/2020-11/msg00039.html x_refsource_MISC
https://packetstormsecurity.com/files/162159/jQuery-1.2-Cross-Site-Scripting.html x_refsource_MISC
https://security.gentoo.org/glsa/202007-03 x_refsource_MISC
https://www.debian.org/security/2020/dsa-4693 x_refsource_MISC
https://www.drupal.org/sa-core-2020-002 x_refsource_MISC
https://www.oracle.com/security-alerts/cpuApr2021.html x_refsource_MISC
https://www.oracle.com/security-alerts/cpuapr2022.html x_refsource_MISC
https://www.oracle.com/security-alerts/cpujan2021.html x_refsource_MISC
https://www.oracle.com/security-alerts/cpujan2022.html x_refsource_MISC
https://www.oracle.com/security-alerts/cpujul2020.html x_refsource_MISC
https://www.oracle.com/security-alerts/cpujul2021.html x_refsource_MISC
https://www.oracle.com/security-alerts/cpujul2022.html x_refsource_MISC
https://www.oracle.com/security-alerts/cpuoct2020.html x_refsource_MISC
https://www.oracle.com/security-alerts/cpuoct2021.html x_refsource_MISC
https://www.tenable.com/security/tns-2020-10 x_refsource_MISC
https://www.tenable.com/security/tns-2020-11 x_refsource_MISC
https://www.tenable.com/security/tns-2021-02 x_refsource_MISC
https://www.tenable.com/security/tns-2021-10 x_refsource_MISC
https://blog.jquery.com/2020/04/10/jquery-3-5-0-released x_refsource_MISC
https://github.com/jquery/jquery/releases/tag/3.5.0 x_refsource_MISC
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/jquery-rails/CVE-2020-11022.yml x_refsource_MISC
https://jquery.com/upgrade-guide/3.5 x_refsource_MISC
https://lists.apache.org/thread.html/r0483ba0072783c2e1bfea613984bfb3c86e73ba8879d780dc1cc7d36@%3Cissues.flink.apache.org%3E x_refsource_MISC
https://lists.apache.org/thread.html/r49ce4243b4738dd763caeb27fa8ad6afb426ae3e8c011ff00b8b1f48@%3Cissues.flink.apache.org%3E x_refsource_MISC
https://lists.apache.org/thread.html/r54565a8f025c7c4f305355fdfd75b68eca442eebdb5f31c2e7d977ae@%3Cissues.flink.apache.org%3E x_refsource_MISC
https://lists.apache.org/thread.html/r564585d97bc069137e64f521e68ba490c7c9c5b342df5d73c49a0760@%3Cissues.flink.apache.org%3E x_refsource_MISC
https://lists.apache.org/thread.html/r706cfbc098420f7113968cc377247ec3d1439bce42e679c11c609e2d@%3Cissues.flink.apache.org%3E x_refsource_MISC
https://lists.apache.org/thread.html/r8f70b0f65d6bedf316ecd899371fd89e65333bc988f6326d2956735c@%3Cissues.flink.apache.org%3E x_refsource_MISC
https://lists.apache.org/thread.html/rbb448222ba62c430e21e13f940be4cb5cfc373cd3bce56b48c0ffa67@%3Cdev.flink.apache.org%3E x_refsource_MISC
https://lists.apache.org/thread.html/rdf44341677cf7eec7e9aa96dcf3f37ed709544863d619cca8c36f133@%3Ccommits.airflow.apache.org%3E x_refsource_MISC
https://lists.apache.org/thread.html/re4ae96fa5c1a2fe71ccbb7b7ac1538bd0cb677be270a2bf6e2f8d108@%3Cissues.flink.apache.org%3E x_refsource_MISC
https://lists.apache.org/thread.html/rede9cfaa756e050a3d83045008f84a62802fc68c17f2b4eabeaae5e4@%3Cissues.flink.apache.org%3E x_refsource_MISC
https://lists.apache.org/thread.html/ree3bd8ddb23df5fa4e372d11c226830ea3650056b1059f3965b3fce2@%3Cissues.flink.apache.org%3E x_refsource_MISC