TROYANOSYVIRUS
Retour aux CVEs

CVE-2020-11023

MEDIUMCISA KEV
6.9

Description

In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.

Details CVE

Score CVSS v3.16.9
SeveriteMEDIUM
Vecteur CVSSCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N
Vecteur d'attaqueNETWORK
ComplexiteHIGH
Privileges requisNONE
Interaction utilisateurREQUIRED
Publie4/29/2020
Derniere modification11/7/2025
Sourcekev
Observations honeypot0

CISA KEV

FournisseurJQuery
ProduitJQuery
Nom vulnerabiliteJQuery Cross-Site Scripting (XSS) Vulnerability
Date ajout KEV2025-01-23
Date limite remediation2025-02-13
Utilise dans ransomwareUnknown

Produits affectes

debian:debian_linuxdrupal:drupalfedoraproject:fedorajquery:jquerynetapp:active_iq_unified_managernetapp:cloud_backupnetapp:cloud_insights_storage_workload_security_agentnetapp:h300enetapp:h300e_firmwarenetapp:h300snetapp:h300s_firmwarenetapp:h410cnetapp:h410c_firmwarenetapp:h410snetapp:h410s_firmwarenetapp:h500enetapp:h500e_firmwarenetapp:h500snetapp:h500s_firmwarenetapp:h700enetapp:h700e_firmwarenetapp:h700snetapp:h700s_firmwarenetapp:hci_baseboard_management_controllernetapp:max_datanetapp:oncommand_insightnetapp:oncommand_system_managernetapp:snap_creator_frameworknetapp:snapcenter_serveroracle:application_expressoracle:application_testing_suiteoracle:banking_enterprise_collectionsoracle:banking_platformoracle:blockchain_platformoracle:business_intelligenceoracle:communications_analyticsoracle:communications_eagle_application_processororacle:communications_element_manageroracle:communications_interactive_session_recorderoracle:communications_operations_monitororacle:communications_services_gatekeeperoracle:communications_session_report_manageroracle:communications_session_route_manageroracle:financial_services_regulatory_reporting_for_de_nederlandsche_bankoracle:financial_services_revenue_management_and_billing_analyticsoracle:health_sciences_informoracle:healthcare_translational_researchoracle:hyperion_financial_reportingoracle:jd_edwards_enterpriseone_orchestratororacle:jd_edwards_enterpriseone_toolsoracle:oss_support_toolsoracle:peoplesoft_enterprise_human_capital_management_resourcesoracle:primavera_gatewayoracle:rest_data_servicesoracle:siebel_mobileoracle:storagetek_acslsoracle:storagetek_tape_analytics_sw_tooloracle:webcenter_sitesoracle:weblogic_servertenable:log_correlation_engine

Faiblesses (CWE)

CWE-79CWE-79

References

https://jquery.com/upgrade-guide/3.5/(security-advisories@github.com)
https://security.gentoo.org/glsa/202007-03(security-advisories@github.com)
https://www.debian.org/security/2020/dsa-4693(security-advisories@github.com)
https://www.drupal.org/sa-core-2020-002(security-advisories@github.com)
https://www.tenable.com/security/tns-2021-02(security-advisories@github.com)
https://www.tenable.com/security/tns-2021-10(security-advisories@github.com)
https://blog.jquery.com/2020/04/10/jquery-3-5-0-released(af854a3a-2127-422b-91ae-364da2661108)
https://jquery.com/upgrade-guide/3.5/(af854a3a-2127-422b-91ae-364da2661108)
https://security.gentoo.org/glsa/202007-03(af854a3a-2127-422b-91ae-364da2661108)
https://security.netapp.com/advisory/ntap-20200511-0006/(af854a3a-2127-422b-91ae-364da2661108)
https://www.debian.org/security/2020/dsa-4693(af854a3a-2127-422b-91ae-364da2661108)
https://www.drupal.org/sa-core-2020-002(af854a3a-2127-422b-91ae-364da2661108)
https://www.oracle.com//security-alerts/cpujul2021.html(af854a3a-2127-422b-91ae-364da2661108)
https://www.oracle.com/security-alerts/cpuApr2021.html(af854a3a-2127-422b-91ae-364da2661108)
https://www.oracle.com/security-alerts/cpuapr2022.html(af854a3a-2127-422b-91ae-364da2661108)
https://www.oracle.com/security-alerts/cpujan2021.html(af854a3a-2127-422b-91ae-364da2661108)
https://www.oracle.com/security-alerts/cpujan2022.html(af854a3a-2127-422b-91ae-364da2661108)
https://www.oracle.com/security-alerts/cpujul2020.html(af854a3a-2127-422b-91ae-364da2661108)
https://www.oracle.com/security-alerts/cpujul2022.html(af854a3a-2127-422b-91ae-364da2661108)
https://www.oracle.com/security-alerts/cpuoct2020.html(af854a3a-2127-422b-91ae-364da2661108)
https://www.oracle.com/security-alerts/cpuoct2021.html(af854a3a-2127-422b-91ae-364da2661108)
https://www.tenable.com/security/tns-2021-02(af854a3a-2127-422b-91ae-364da2661108)
https://www.tenable.com/security/tns-2021-10(af854a3a-2127-422b-91ae-364da2661108)

Correlations IOC

Aucune correlation enregistree

This product uses data from the NVD API but is not endorsed or certified by the NVD.