← back
CVE-2020-11022

jQuery has a potential XSS vulnerability

CVSS 6.9 MEDIUMEPSS 99.0%CWE-79
In jQuery starting with 1.12.0 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N
Affected products
jquery · jQuery
public PoCs found — 7
githubgithub.com/0xAJ2K/CVE-2020-11022-CVE-2020-11023★ 35githubgithub.com/Snorlyd/https-nj.gov---CVE-2020-11022★ 1githubgithub.com/ibnurusdianto/CVE-2020-11022★ 1githubgithub.com/okni2k/HW-Pyton-10★ 0cve_referencepacketstormsecurity.com/files/162159/jQuery-1.2-Cross-Site-Scripting.htmlunverifiedexploitdbwww.exploit-db.com/exploits/49766unverifiedcve_referencepacketstormsecurity.com/files/162159/jQuery-1.2-Cross-Site-Scripting.htmlunverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →
References
http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00067.htmlhttp://lists.opensuse.org/opensuse-security-announce/2020-07/msg00085.htmlhttp://lists.opensuse.org/opensuse-security-announce/2020-11/msg00039.htmlhttp://packetstormsecurity.com/files/162159/jQuery-1.2-Cross-Site-Scripting.htmlhttps://blog.jquery.com/2020/04/10/jquery-3-5-0-releasedhttps://blog.jquery.com/2020/04/10/jquery-3-5-0-released/http://security.netapp.com/advisory/ntap-20200511-0006https://github.com/jquery/jquery/commit/1d61fd9407e6fbe82fe55cb0b938307aa0791f77https://github.com/jquery/jquery/releases/tag/3.5.0https://github.com/jquery/jquery/security/advisories/GHSA-gxr4-xjj5-5px2https://github.com/maximebf/php-debugbar/commit/847216e60544258c881f2733d699bbcfeefac0fchttps://github.com/maximebf/php-debugbar/issues/447