CVE-2020-11022
Summary
| CVE | CVE-2020-11022 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2020-04-29 22:15:00 UTC |
| Updated | 2023-11-07 03:14:00 UTC |
| Description | In jQuery versions greater than or equal to 1.2 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0. |
Risk And Classification
Problem Types: CWE-79
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| [SECURITY] Fedora 32 Update: drupal7-7.70-1.fc32 - package-announce - Fedora Mailing-Lists | FEDORA | lists.fedoraproject.org | Third Party Advisory |
| [security-announce] openSUSE-SU-2020:1106-1: moderate: Security update f | SUSE | lists.opensuse.org | Mailing List, Third Party Advisory |
| [security-announce] openSUSE-SU-2020:1060-1: moderate: Security update f | SUSE | lists.opensuse.org | Mailing List, Third Party Advisory |
| [SECURITY] Fedora 33 Update: drupal7-7.72-1.fc33 - package-announce - Fedora Mailing-Lists | lists.fedoraproject.org | ||
| Pony Mail! | lists.apache.org | ||
| [security-announce] openSUSE-SU-2020:1888-1: moderate: Security update f | SUSE | lists.opensuse.org | Mailing List, Third Party Advisory |
| Pony Mail! | lists.apache.org | ||
| Oracle Critical Patch Update Advisory - July 2020 | MISC | www.oracle.com | Third Party Advisory |
| Potential XSS vulnerability in jQuery.htmlPrefilter and related methods · Advisory · jquery/jquery · GitHub | CONFIRM | github.com | Mitigation, Third Party Advisory |
| May 2020 jQuery Vulnerabilities in NetApp Products | NetApp Product Security | CONFIRM | security.netapp.com | Third Party Advisory |
| jQuery Core 3.5 Upgrade Guide | jQuery | MISC | jquery.com | Mitigation, Vendor Advisory |
| Oracle Critical Patch Update Advisory - April 2022 | MISC | www.oracle.com | |
| Pony Mail! | MLIST | lists.apache.org | Mailing List, Third Party Advisory |
| [R1] Nessus 8.13.0 Fixes One Third-party Vulnerability - Security Advisory | Tenable® | CONFIRM | www.tenable.com | Third Party Advisory |
| [SECURITY] Fedora 31 Update: drupal7-7.72-1.fc31 - package-announce - Fedora Mailing-Lists | FEDORA | lists.fedoraproject.org | Third Party Advisory |
| Pony Mail! | lists.apache.org | ||
| [flink-issues] 20211031 [jira] [Updated] (FLINK-20014) Resolve CVE-2020-11022 and CVE-2020-11023 in scala-compiler | lists.apache.org | ||
| Oracle Critical Patch Update Advisory - October 2020 | MISC | www.oracle.com | Third Party Advisory |
| Pony Mail! | lists.apache.org | ||
| Oracle Critical Patch Update Advisory - July 2021 | N/A | www.oracle.com | |
| Pony Mail! | MLIST | lists.apache.org | |
| [SECURITY] [DLA 2608-1] jquery security update | MLIST | lists.debian.org | |
| [R1] Tenable.sc 5.17.0 Fixes Multiple Vulnerabilities - Security Advisory | Tenable® | CONFIRM | www.tenable.com | Third Party Advisory |
| Pony Mail! | MLIST | lists.apache.org | |
| Drupal core - Moderately critical - Cross Site Scripting - SA-CORE-2020-002 | Drupal.org | CONFIRM | www.drupal.org | Third Party Advisory |
| [SECURITY] Fedora 31 Update: drupal7-7.72-1.fc31 - package-announce - Fedora Mailing-Lists | lists.fedoraproject.org | ||
| Oracle Critical Patch Update Advisory - October 2021 | MISC | www.oracle.com | |
| Pony Mail! | MLIST | lists.apache.org | Mailing List, Third Party Advisory |
| [R1] LCE 6.0.9 Fixes Multiple Third-party Vulnerabilities - Security Advisory | Tenable® | CONFIRM | www.tenable.com | |
| Cacti: Multiple vulnerabilities (GLSA 202007-03) — Gentoo security | GENTOO | security.gentoo.org | Third Party Advisory |
| Pony Mail! | MLIST | lists.apache.org | |
| jQuery 3.5.0 Released! | Official jQuery Blog | MISC | blog.jquery.com | Release Notes, Vendor Advisory |
| Oracle Critical Patch Update Advisory - January 2022 | MISC | www.oracle.com | |
| Pony Mail! | lists.apache.org | ||
| Manipulation: Make jQuery.htmlPrefilter an identity function · jquery/jquery@1d61fd9 · GitHub | MISC | github.com | Patch, Third Party Advisory |
| [SECURITY] [DLA 3551-1] otrs2 security update | MLIST | lists.debian.org | |
| Pony Mail! | lists.apache.org | ||
| Pony Mail! | lists.apache.org | ||
| Pony Mail! | MLIST | lists.apache.org | Mailing List, Third Party Advisory |
| [SECURITY] Fedora 32 Update: drupal7-7.72-1.fc32 - package-announce - Fedora Mailing-Lists | lists.fedoraproject.org | ||
| [SECURITY] Fedora 32 Update: drupal8-8.9.0-1.fc32 - package-announce - Fedora Mailing-Lists | FEDORA | lists.fedoraproject.org | Third Party Advisory |
| Pony Mail! | lists.apache.org | ||
| Pony Mail! | MLIST | lists.apache.org | |
| [R1] Nessus Network Monitor 5.13.0 Fixes One Third-party Vulnerability - Security Advisory | Tenable® | CONFIRM | www.tenable.com | Third Party Advisory |
| Debian -- Security Information -- DSA-4693-1 drupal7 | DEBIAN | www.debian.org | Third Party Advisory |
| Pony Mail! | MLIST | lists.apache.org | Mailing List, Third Party Advisory |
| Pony Mail! | lists.apache.org | ||
| Pony Mail! | lists.apache.org | ||
| [SECURITY] Fedora 33 Update: drupal7-7.72-1.fc33 - package-announce - Fedora Mailing-Lists | FEDORA | lists.fedoraproject.org | Third Party Advisory |
| jQuery 1.2 Cross Site Scripting ≈ Packet Storm | MISC | packetstormsecurity.com | |
| Pony Mail! | MLIST | lists.apache.org | Mailing List, Third Party Advisory |
| [SECURITY] Fedora 32 Update: drupal8-8.9.0-1.fc32 - package-announce - Fedora Mailing-Lists | lists.fedoraproject.org | ||
| [SECURITY] Fedora 32 Update: drupal7-7.70-1.fc32 - package-announce - Fedora Mailing-Lists | lists.fedoraproject.org | ||
| Pony Mail! | MLIST | lists.apache.org | Mailing List, Third Party Advisory |
| Oracle Critical Patch Update Advisory - July 2022 | N/A | www.oracle.com | |
| Oracle Critical Patch Update Advisory - April 2021 | MISC | www.oracle.com | |
| Pony Mail! | MLIST | lists.apache.org | |
| Oracle Critical Patch Update Advisory - January 2021 | MISC | www.oracle.com | Third Party Advisory |
| [SECURITY] Fedora 32 Update: drupal7-7.72-1.fc32 - package-announce - Fedora Mailing-Lists | FEDORA | lists.fedoraproject.org | Third Party Advisory |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 10083 Atlassian Jira Cross-Site Scripting Vulnerability(JRASERVER-72052)
- 14011 Ansible Tower Security Update 3.8.2 Multiple Vulnerabilities
- 159652 Oracle Enterprise Linux Security Update for idm:dl1 and idm:client (ELSA-2020-4670)
- 159661 Oracle Enterprise Linux Security Update for jquery-ui (ELSA-2022-9177)
- 159679 Oracle Enterprise Linux Security Update for pki-core:10.6 and pki-deps:10.6 (ELSA-2020-4847)
- 178505 Debian Security Update for jquery (DLA 2608-1)
- 20288 Oracle Database 19c Critical OJVM Patch Update - October 2020
- 20297 Oracle Database 18c Critical OJVM Patch Update - October 2020
- 20313 Oracle Database 12.2.0.1 Critical OJVM Patch Update - October 2020
- 241153 Red Hat Update for JBoss Enterprise Application Platform 7.4.9 (RHSA-2023:0554)
- 241154 Red Hat Update for JBoss Enterprise Application Platform 7.4.9 (RHSA-2023:0552)
- 241155 Red Hat Update for JBoss Enterprise Application Platform 7.4.9 (RHSA-2023:0553)
- 296073 Oracle Solaris 11.4 Support Repository Update (SRU) 24.75.2 Missing (CPUJUL2020)
- 375482 Oracle PeopleSoft Enterprise PeopleTools Product Multiple Vulnerabilities (CPUAPR2021)
- 375584 Dell NetWorker Security Update for Multiple Vulnerabilities (DSA-2020-262)
- 375630 HPE System Management Homepage Cross Site Scripting Vulnerabilitiy
- 377492 Alibaba Cloud Linux Security Update for ipa (ALINUX2-SA-2020:0169)
- 500875 Alpine Linux Security Update for drupal7
- 501529 Alpine Linux Security Update for cacti
- 504593 Alpine Linux Security Update for cacti
- 504699 Alpine Linux Security Update for drupal7
- 590764 Mitsubishi Electric EcoWebServerIII Multiple Vulnerabilities (ICSA-22-055-02)
- 590808 Mitsubishi Electric EcoWebServerIII Multiple Vulnerabilities (ICSA-22-055-02)
- 6000085 Debian Security Update for otrs2 (DLA 3551-1)
- 690483 Free Berkeley Software Distribution (FreeBSD) Security Update for cacti (cd2dc126-cfe4-11ea-9172-4c72b94353b5)
- 690498 Free Berkeley Software Distribution (FreeBSD) Security Update for gitlab (1fb13175-ed52-11ea-8b93-001b217b3468)
- 87467 Oracle WebLogic Server Multiple Vulnerabilities (CPUOCT2021)
- 940071 AlmaLinux Security Update for idm:DL1 and idm:client (ALSA-2020:4670)
- 940348 AlmaLinux Security Update for pki-core:10.6 and pki-deps:10.6 (ALSA-2020:4847)
- 960340 Rocky Linux Security Update for idm:DL1 and idm:client (RLSA-2020:4670)
- 960454 Rocky Linux Security Update for pki-core:10.6 and pki-deps:10.6 (RLSA-2020:4847)
- 980083 Nodejs (npm) Security Update for jquery (GHSA-gxr4-xjj5-5px2)
- 995403 DotNet (Nuget) Security Update for jquery (GHSA-gxr4-xjj5-5px2)
- 995409 Rubygems (Rubygems) Security Update for jquery-rails (GHSA-gxr4-xjj5-5px2)
- 995461 Java (Maven) Security Update for org.webjars.npm:jquery (GHSA-gxr4-xjj5-5px2)