CVE-2020-11022

medium Tenable
CVSS v3 Base Score
6.9
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N
EPSS Score
2.1%
Exploitation probability in 30 days
Top 16% most likely to be exploited
Attack Characteristics
Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
Required
Confidentiality
High
Integrity
Low
Availability
None
Published: April 29, 2020 (2205 days ago)
Last Modified: April 13, 2026
Vendor: Tenable
Source: NVD

Description

In jQuery starting with 1.12.0 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.

CWE

CWE-79

Affected Products

jquery jquerydrupal drupaldebian debian linuxfedoraproject fedoraoracle agile product lifecycle management for processoracle application testing suiteoracle banking digital experienceoracle blockchain platformoracle communications application session controlleroracle communications billing and revenue management

References

🔗 security.netapp.com 🔗 blog.jquery.com 🔗 github.com 🔗 github.com 🔗 github.com