Back to CVE records
Medium 6.9HealthcarePublished Apr 29, 2020
CVE-2020-11022jQuery has a potential XSS vulnerability
Updated under an hour ago ()
Does this affect you?
It affects jQuery and 58 other products. Add what you run to find out whether that includes you.
EPSS puts the chance of exploitation in the next 30 days at 99.22%, higher than 100% of scored CVEs. That is high: schedule it on your emergency patch path.
Do this next
Start free and add your stack
Free account, 1 product
In jQuery starting with 1.12.0 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.
- CVSS
- 6.9 MEDIUM (v3.1, CNA)CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N
- Weakness (CWE)
- CWE-79
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- 99.22% (percentile 100)
- Assigned by
- GitHub_M
- NVD analysis
- Modified
- Record last updated
- Apr 13, 2026
- First seen by InfoSec Signals
- Oct 12, 2026
Affected products
jquery jQuery jquery:jquery (from the name) | from 1.12.0, < 3.5.0 | CNA record |
jquery jquery jquery:jquery | from 1.2 before 3.5.0 | NVD |
drupal drupal drupal:drupal | from 7.0 before 7.70; from 8.7.0 before 8.7.14; from 8.8.0 before 8.8.6 | NVD |
debian debian_linux debian:debian_linux | 9.0 | NVD |
fedoraproject fedora fedoraproject:fedora | 31; 32; 33 | NVD |
oracle agile_product_lifecycle_management_for_process oracle:agile_product_lifecycle_management_for_process | 6.2.0.0 | NVD |
oracle application_testing_suite oracle:application_testing_suite | 13.3.0.1 | NVD |
oracle banking_digital_experience oracle:banking_digital_experience | 18.1; 18.2; 18.3; 19.1; 19.2; 20.1; from 18.1 through 20.1 | NVD |
oracle blockchain_platform oracle:blockchain_platform | before 21.1.2 | NVD |
oracle communications_application_session_controller oracle:communications_application_session_controller | 3.8m0; 3.8m0 | NVD |
oracle communications_billing_and_revenue_management oracle:communications_billing_and_revenue_management | 7.5.0.23.0; 12.0.0.3.0; 7.5.0.23.0; 12.0.0.3.0 | NVD |
oracle communications_diameter_signaling_router_idih: oracle:communications_diameter_signaling_router_idih: | from 8.0.0 through 8.2.2; from 8.0.0 through 8.2.2 | NVD |
oracle communications_eagle_application_processor oracle:communications_eagle_application_processor | from 16.1.0 through 16.4.0 | NVD |
oracle communications_services_gatekeeper oracle:communications_services_gatekeeper | 7.0 | NVD |
oracle communications_webrtc_session_controller oracle:communications_webrtc_session_controller | 7.2; 7.2 | NVD |
oracle enterprise_manager_ops_center oracle:enterprise_manager_ops_center | 12.4.0.0; 12.4.0.0 | NVD |
oracle enterprise_session_border_controller oracle:enterprise_session_border_controller | 8.4; 8.4 | NVD |
oracle financial_services_analytical_applications_infrastructure oracle:financial_services_analytical_applications_infrastructure | from 8.0.6.0.0 through 8.1.0.0.0; from 8.0.6 through 8.1.0 | NVD |
oracle financial_services_analytical_applications_reconciliation_framework oracle:financial_services_analytical_applications_reconciliation_framework | from 8.0.6 through 8.0.8; 8.1.0; from 8.0.6 through 8.0.8; 8.1.0 | NVD |
oracle financial_services_asset_liability_management oracle:financial_services_asset_liability_management | 8.0.6; 8.0.7; 8.1.0; 8.0.6; 8.0.7; 8.1.0 | NVD |
oracle financial_services_balance_sheet_planning oracle:financial_services_balance_sheet_planning | 8.0.8; 8.0.8 | NVD |
oracle financial_services_basel_regulatory_capital_basic oracle:financial_services_basel_regulatory_capital_basic | from 8.0.6 through 8.0.8; 8.1.0; from 8.0.6 through 8.0.8; 8.1.0 | NVD |
oracle financial_services_basel_regulatory_capital_internal_ratings_based_approach oracle:financial_services_basel_regulatory_capital_internal_ratings_based_approach | from 8.0.6 through 8.0.8; 8.1.0; from 8.0.6 through 8.0.8; 8.1.0 | NVD |
oracle financial_services_data_foundation oracle:financial_services_data_foundation | from 8.0.6 through 8.1.0; from 8.0.6 through 8.1.0 | NVD |
oracle financial_services_data_governance_for_us_regulatory_reporting oracle:financial_services_data_governance_for_us_regulatory_reporting | from 8.0.6 through 8.0.9; from 8.0.6 through 8.0.9 | NVD |
oracle financial_services_data_integration_hub oracle:financial_services_data_integration_hub | 8.0.6; 8.0.7; 8.1.0; 8.0.6; 8.0.7; 8.1.0 | NVD |
oracle financial_services_funds_transfer_pricing oracle:financial_services_funds_transfer_pricing | 8.0.6; 8.0.7; 8.1.0; 8.0.6; 8.0.7; 8.1.0 | NVD |
oracle financial_services_hedge_management_and_ifrs_valuations oracle:financial_services_hedge_management_and_ifrs_valuations | from 8.0.6 through 8.0.8; 8.1.0; from 8.0.6 through 8.0.8; 8.1.0 | NVD |
oracle financial_services_institutional_performance_analytics oracle:financial_services_institutional_performance_analytics | 8.0.6; 8.0.7; 8.1.0; 8.0.6; 8.0.7; 8.1.0 | NVD |
oracle financial_services_liquidity_risk_management oracle:financial_services_liquidity_risk_management | 8.0.6; 8.0.6 | NVD |
oracle financial_services_liquidity_risk_measurement_and_management oracle:financial_services_liquidity_risk_measurement_and_management | 8.0.7; 8.0.8; 8.1.0; 8.0.7; 8.0.8; 8.1.0 | NVD |
oracle financial_services_loan_loss_forecasting_and_provisioning oracle:financial_services_loan_loss_forecasting_and_provisioning | from 8.0.6 through 8.0.8; 8.1.0; from 8.0.6 through 8.0.8; 8.1.0 | NVD |
oracle financial_services_market_risk_measurement_and_management oracle:financial_services_market_risk_measurement_and_management | 8.0.6; 8.0.8; 8.0.6; 8.0.8 | NVD |
oracle financial_services_price_creation_and_discovery oracle:financial_services_price_creation_and_discovery | 8.0.6; 8.0.7; 8.0.6; 8.0.7 | NVD |
oracle financial_services_profitability_management oracle:financial_services_profitability_management | 8.0.6; 8.0.7; 8.1.0; 8.0.6; 8.0.7; 8.1.0 | NVD |
oracle financial_services_regulatory_reporting_for_european_banking_authority oracle:financial_services_regulatory_reporting_for_european_banking_authority | from 8.0.6 through 8.1.0; from 8.0.6 through 8.1.0 | NVD |
oracle financial_services_regulatory_reporting_for_us_federal_reserve oracle:financial_services_regulatory_reporting_for_us_federal_reserve | from 8.0.6 through 8.0.9; from 8.0.6 through 8.0.9 | NVD |
oracle healthcare_foundation oracle:healthcare_foundation | 7.1.1; 7.2.0; 7.2.1; 7.3.0; 7.1.1; 7.2.0; 7.2.1; 7.3.0 | NVD |
oracle hospitality_materials_control oracle:hospitality_materials_control | 18.1; 18.1 | NVD |
oracle hospitality_simphony oracle:hospitality_simphony | from 19.1.0 through 19.1.2; 18.1; 18.2; 18.1; 18.2; 19.1.0-19.1.2 | NVD |
oracle insurance_accounting_analyzer oracle:insurance_accounting_analyzer | 8.0.9; 8.0.9 | NVD |
oracle insurance_allocation_manager_for_enterprise_profitability oracle:insurance_allocation_manager_for_enterprise_profitability | 8.0.8; 8.1.0; 8.0.8; 8.1.0 | NVD |
oracle insurance_data_foundation oracle:insurance_data_foundation | from 8.0.6 through 8.1.0; 8.0.6-8.1.0 | NVD |
oracle insurance_insbridge_rating_and_underwriting oracle:insurance_insbridge_rating_and_underwriting | from 5.0.0.0 through 5.6.0.0; 5.6.1.0; from 5.0.0.0 through 5.6.0.0; 5.6.1.0 | NVD |
oracle jdeveloper oracle:jdeveloper | 11.1.1.9.0; 12.2.1.3.0; 12.2.1.4.0; 11.1.1.9.0; 12.2.1.3.0; 12.2.1.4.0 | NVD |
oracle peoplesoft_enterprise_peopletools oracle:peoplesoft_enterprise_peopletools | 8.56; 8.57; 8.58; 8.56; 8.57; 8.58 | NVD |
oracle policy_automation oracle:policy_automation | from 12.2.0 through 12.2.20; from 12.2.0 through 12.2.20 | NVD |
oracle policy_automation_connector_for_siebel oracle:policy_automation_connector_for_siebel | 10.4.6; 10.4.6 | NVD |
oracle policy_automation_for_mobile_devices oracle:policy_automation_for_mobile_devices | from 12.2.0 through 12.2.20; from 12.2.0 through 12.2.20 | NVD |
oracle retail_back_office oracle:retail_back_office | 14.0; 14.1; 14.0; 14.1 | NVD |
oracle retail_customer_management_and_segmentation_foundation oracle:retail_customer_management_and_segmentation_foundation | 19.0; 19.0 | NVD |
oracle retail_returns_management oracle:retail_returns_management | 14.0; 14.1; 14.0; 14.1 | NVD |
oracle siebel_ui_framework oracle:siebel_ui_framework | 20.8; 20.8 | NVD |
oracle storagetek_acsls oracle:storagetek_acsls | 8.5.1 | NVD |
oracle weblogic_server oracle:weblogic_server | 10.3.6.0.0; 12.1.3.0.0; 12.2.1.3.0; 12.2.1.4.0; 14.1.1.0.0; 10.3.6.0.0; 12.1.3.0.0; 12.2.1.3.0; and 2 more ranges | NVD |
netapp max_data netapp:max_data | all versions | NVD |
netapp oncommand_insight netapp:oncommand_insight | all versions | NVD |
netapp oncommand_system_manager netapp:oncommand_system_manager | from 3.0 through 3.1.3 | NVD |
netapp snap_creator_framework netapp:snap_creator_framework | all versions | NVD |
netapp snapcenter netapp:snapcenter | all versions | NVD |
References
- https://github.com/jquery/jquery/security/advisories/GHSA-gxr4-xjj5-5px2x-refsource-confirm, mitigation, third-party-advisory
- https://github.com/maximebf/php-debugbar/issues/447x-refsource-misc
- https://github.com/jquery/jquery/commit/1d61fd9407e6fbe82fe55cb0b938307aa0791f77x-refsource-misc, patch, third-party-advisory
- https://github.com/maximebf/php-debugbar/commit/847216e60544258c881f2733d699bbcfeefac0fcx-refsource-misc
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VOE7P7APPRQKD4FGNHBKJPDY6FFCOH3Wx-refsource-misc
- https://lists.opensuse.org/opensuse-security-announce/2020-07/msg00067.htmlx-refsource-misc
- https://lists.opensuse.org/opensuse-security-announce/2020-07/msg00085.htmlx-refsource-misc
- https://lists.opensuse.org/opensuse-security-announce/2020-11/msg00039.htmlx-refsource-misc
- https://packetstormsecurity.com/files/162159/jQuery-1.2-Cross-Site-Scripting.htmlx-refsource-misc
- https://security.gentoo.org/glsa/202007-03x-refsource-misc
- https://www.debian.org/security/2020/dsa-4693x-refsource-misc
- https://www.drupal.org/sa-core-2020-002x-refsource-misc
- https://www.oracle.com/security-alerts/cpuApr2021.htmlx-refsource-misc
- https://www.oracle.com/security-alerts/cpuapr2022.htmlx-refsource-misc
- https://www.oracle.com/security-alerts/cpujan2021.htmlx-refsource-misc
- https://www.oracle.com/security-alerts/cpujan2022.htmlx-refsource-misc
- https://www.oracle.com/security-alerts/cpujul2020.htmlx-refsource-misc
- https://www.oracle.com/security-alerts/cpujul2021.htmlx-refsource-misc
- https://www.oracle.com/security-alerts/cpujul2022.htmlx-refsource-misc
- https://www.oracle.com/security-alerts/cpuoct2020.htmlx-refsource-misc
- https://www.oracle.com/security-alerts/cpuoct2021.htmlx-refsource-misc
- https://www.tenable.com/security/tns-2020-10x-refsource-misc
- https://www.tenable.com/security/tns-2020-11x-refsource-misc
- https://www.tenable.com/security/tns-2021-02x-refsource-misc
- https://www.tenable.com/security/tns-2021-10x-refsource-misc
- http://security.netapp.com/advisory/ntap-20200511-0006
- https://blog.jquery.com/2020/04/10/jquery-3-5-0-released
- https://github.com/jquery/jquery/releases/tag/3.5.0
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/jquery-rails/CVE-2020-11022.yml
- https://jquery.com/upgrade-guide/3.5
- https://lists.apache.org/thread.html/r0483ba0072783c2e1bfea613984bfb3c86e73ba8879d780dc1cc7d36@%3Cissues.flink.apache.org%3E
- https://lists.apache.org/thread.html/r49ce4243b4738dd763caeb27fa8ad6afb426ae3e8c011ff00b8b1f48@%3Cissues.flink.apache.org%3E
- https://lists.apache.org/thread.html/r54565a8f025c7c4f305355fdfd75b68eca442eebdb5f31c2e7d977ae@%3Cissues.flink.apache.org%3E
- https://lists.apache.org/thread.html/r564585d97bc069137e64f521e68ba490c7c9c5b342df5d73c49a0760@%3Cissues.flink.apache.org%3E
- https://lists.apache.org/thread.html/r706cfbc098420f7113968cc377247ec3d1439bce42e679c11c609e2d@%3Cissues.flink.apache.org%3E
- https://lists.apache.org/thread.html/r8f70b0f65d6bedf316ecd899371fd89e65333bc988f6326d2956735c@%3Cissues.flink.apache.org%3E
- https://lists.apache.org/thread.html/rbb448222ba62c430e21e13f940be4cb5cfc373cd3bce56b48c0ffa67@%3Cdev.flink.apache.org%3E
- https://lists.apache.org/thread.html/rdf44341677cf7eec7e9aa96dcf3f37ed709544863d619cca8c36f133@%3Ccommits.airflow.apache.org%3E
- https://lists.apache.org/thread.html/re4ae96fa5c1a2fe71ccbb7b7ac1538bd0cb677be270a2bf6e2f8d108@%3Cissues.flink.apache.org%3E
- https://lists.apache.org/thread.html/rede9cfaa756e050a3d83045008f84a62802fc68c17f2b4eabeaae5e4@%3Cissues.flink.apache.org%3E
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.