$ cve CVE-2020-11023 JSON

CVE-2020-11023 KEV EXPLOIT

6.9

MEDIUM · CVSS 3.1 · EPSS 84.9% (pctl 100)

Patch first

On CISA KEV — known exploited in the wild, due 2025-02-13.

Description

In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.

Scoring

CVSS	6.9 (MEDIUM, v3.1)
Vector	CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N
EPSS	84.89% — more likely to be exploited than 100% of all CVEs
Weakness	CWE-79
On CISA KEV	yes — remediate by 2025-02-13
Public exploit	yes
Published	2020-04-29
Last modified	2026-06-17

CISA KEV

Name	JQuery Cross-Site Scripting (XSS) Vulnerability
Added	2025-01-23
Due	2025-02-13
Vendor / product	JQuery / JQuery
Ransomware use	none reported

Affected (40)

Vendor	Product
debian	debian linux
drupal	drupal
fedoraproject	fedora
jquery	jquery
netapp	h300s
netapp	h300s firmware
netapp	h500s
netapp	h500s firmware
netapp	h700s
netapp	h700s firmware
oracle	application express
oracle	application testing suite
oracle	banking enterprise collections
oracle	banking platform
oracle	blockchain platform
oracle	business intelligence
oracle	communications analytics
oracle	communications eagle application processor
oracle	communications element manager
oracle	communications interactive session recorder
oracle	communications operations monitor
oracle	communications services gatekeeper
oracle	communications session report manager
oracle	communications session route manager
oracle	financial services regulatory reporting for de nederlandsche bank
oracle	financial services revenue management and billing analytics
oracle	health sciences inform
oracle	healthcare translational research
oracle	hyperion financial reporting
oracle	jd edwards enterpriseone orchestrator
oracle	jd edwards enterpriseone tools
oracle	oss support tools
oracle	peoplesoft enterprise human capital management resources
oracle	primavera gateway
oracle	rest data services
oracle	siebel mobile
oracle	storagetek acsls
oracle	storagetek tape analytics sw tool
oracle	webcenter sites
oracle	weblogic server

Public exploits

Source	Title	Date
exploit-db	jQuery 1.0.3 - Cross-Site Scripting (XSS)	2021-04-14

References

→ the Explorer · watch your stack · NVD