Vulnerability · Published May 19, 2020 · Assigned by snyk
CVE-2020-7656
Medium 6.1
In plain English
A medium-severity security flaw in jquery. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 6.4% (higher than 94% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)6.1Medium
Exploit odds (30 days)6.4%top 6.3% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
jquery prior to 1.9.0 allows Cross-site Scripting attacks via the load method. The load method fails to recognize and remove "<script>" HTML tags that contain a whitespace character, i.e: "</script >", which results in the enclosed script logic to be executed.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | pcs | 0.10.10-4.el8.alma | ALSA-2021:4142 |
| AlmaLinux:8 | pcs-snmp | 0.10.10-4.el8.alma | ALSA-2021:4142 |
| Maven | org.webjars.npm:jquery | 1.9.0 | GHSA-q4m3-2j7h-f7xw |
| NuGet | jquery | 1.9.0 | GHSA-q4m3-2j7h-f7xw |
| Rocky Linux:8 | pcs | 0:0.10.10-4.el8 | RLSA-2021:4142 |
| RubyGems | jquery-rails | 2.2.0 | GHSA-q4m3-2j7h-f7xw |
| npm | jquery | 1.9.0 | GHSA-q4m3-2j7h-f7xw |
Affected products (as reported)
References
- https://security.netapp.com/advisory/ntap-20200528-0001/
- https://www.oracle.com/security-alerts/cpujul2022.html
- https://snyk.io/vuln/SNYK-JS-JQUERY-569619
- https://supportportal.juniper.net/s/article/2021-07-Security-Bulletin-Junos-OS-Multiple-J-Web-vulnerabilities-resolved-in-Junos-OS-21-2R1?language=en_US