Back to CVE records
Medium 6.9Known exploited (CISA KEV)HealthcarePublished Apr 29, 2020
CVE-2020-11023Potential XSS vulnerability in jQuery
Updated under an hour ago ()
Does this affect you?
It affects jQuery and 51 other products. Add what you run to find out whether that includes you.
CISA lists it as known exploited since Jan 23, 2025; federal agencies had to remediate by Feb 13, 2025. Treat that date as your deadline.
Do this next
Start free and add your stack
Free account, 1 product
In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.
- CVSS
- 6.9 MEDIUM (v3.1, CNA)CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N
- Weakness (CWE)
- CWE-79
- Known exploited
- Added to CISA KEV Jan 23, 2025; federal remediation due Feb 13, 2025Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- EPSS (exploitation in the next 30 days)
- 84.89% (percentile 100)
- Assigned by
- GitHub_M
- NVD analysis
- Analyzed
- Record last updated
- Oct 21, 2025
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
jquery jQuery jquery:jquery (from the name) | from 1.0.3, < 3.5.0 | CNA record |
jquery jquery jquery:jquery | from 1.0.3 before 3.5.0 | NVD |
debian debian_linux debian:debian_linux | 9.0 | NVD |
fedoraproject fedora fedoraproject:fedora | 31; 32; 33 | NVD |
drupal drupal drupal:drupal | from 7.0 before 7.70; from 8.7.0 before 8.7.14; from 8.8.0 before 8.8.6 | NVD |
oracle application_express oracle:application_express | before 20.2 | NVD |
oracle application_testing_suite oracle:application_testing_suite | 13.3.0.1 | NVD |
oracle banking_enterprise_collections oracle:banking_enterprise_collections | from 2.7.0 through 2.8.0 | NVD |
oracle banking_platform oracle:banking_platform | from 2.4.0 through 2.10.0 | NVD |
oracle blockchain_platform oracle:blockchain_platform | before 21.1.2; 21.1.2 | NVD |
oracle business_intelligence oracle:business_intelligence | 5.9.0.0.0 | NVD |
oracle communications_analytics oracle:communications_analytics | 12.1.1 | NVD |
oracle communications_eagle_application_processor oracle:communications_eagle_application_processor | from 16.1.0 through 16.4.0 | NVD |
oracle communications_element_manager oracle:communications_element_manager | 8.1.1; 8.2.0; 8.2.1 | NVD |
oracle communications_interactive_session_recorder oracle:communications_interactive_session_recorder | from 6.1 through 6.4 | NVD |
oracle communications_operations_monitor oracle:communications_operations_monitor | from 4.1 through 4.3; 3.4 | NVD |
oracle communications_services_gatekeeper oracle:communications_services_gatekeeper | 7.0 | NVD |
oracle communications_session_report_manager oracle:communications_session_report_manager | 8.1.1; 8.2.0; 8.2.1 | NVD |
oracle communications_session_route_manager oracle:communications_session_route_manager | 8.1.1; 8.2.0; 8.2.1 | NVD |
oracle financial_services_regulatory_reporting_for_de_nederlandsche_bank oracle:financial_services_regulatory_reporting_for_de_nederlandsche_bank | 8.0.4 | NVD |
oracle financial_services_revenue_management_and_billing_analytics oracle:financial_services_revenue_management_and_billing_analytics | 2.7; 2.8 | NVD |
oracle health_sciences_inform oracle:health_sciences_inform | 6.3.0 | NVD |
oracle healthcare_translational_research oracle:healthcare_translational_research | 3.2.1; 3.3.1; 3.3.2; 3.4.0 | NVD |
oracle hyperion_financial_reporting oracle:hyperion_financial_reporting | 11.1.2.4 | NVD |
oracle jd_edwards_enterpriseone_orchestrator oracle:jd_edwards_enterpriseone_orchestrator | before 9.2.5.0 | NVD |
oracle jd_edwards_enterpriseone_tools oracle:jd_edwards_enterpriseone_tools | before 9.2.5.0 | NVD |
oracle oss_support_tools oracle:oss_support_tools | before 2.12.41 | NVD |
oracle peoplesoft_enterprise_human_capital_management_resources oracle:peoplesoft_enterprise_human_capital_management_resources | 9.2 | NVD |
oracle primavera_gateway oracle:primavera_gateway | from 16.2 through 16.2.11; from 17.12.0 through 17.12.7; from 18.8.0 through 18.8.9; from 19.12.0 through 19.12.4 | NVD |
oracle rest_data_services oracle:rest_data_services | 11.2.0.4; 12.1.0.2; 12.2.0.1; 18c; 19c | NVD |
oracle siebel_mobile oracle:siebel_mobile | through 20.12 | NVD |
oracle storagetek_acsls oracle:storagetek_acsls | 8.5.1 | NVD |
oracle storagetek_tape_analytics_sw_tool oracle:storagetek_tape_analytics_sw_tool | 2.3.1 | NVD |
oracle webcenter_sites oracle:webcenter_sites | 12.2.1.3.0; 12.2.1.4.0 | NVD |
oracle weblogic_server oracle:weblogic_server | 12.1.3.0.0; 12.2.1.3.0; 12.2.1.4.0; 14.1.1.0.0 | NVD |
netapp h300s_firmware netapp:h300s_firmware | all versions | NVD |
netapp h500s_firmware netapp:h500s_firmware | all versions | NVD |
netapp h700s_firmware netapp:h700s_firmware | all versions | NVD |
netapp h300e_firmware netapp:h300e_firmware | all versions | NVD |
netapp h500e_firmware netapp:h500e_firmware | all versions | NVD |
netapp h700e_firmware netapp:h700e_firmware | all versions | NVD |
netapp h410s_firmware netapp:h410s_firmware | all versions | NVD |
netapp h410c_firmware netapp:h410c_firmware | all versions | NVD |
netapp active_iq_unified_manager netapp:active_iq_unified_manager | all versions; all versions; all versions | NVD |
netapp cloud_backup netapp:cloud_backup | all versions | NVD |
netapp cloud_insights_storage_workload_security_agent netapp:cloud_insights_storage_workload_security_agent | all versions | NVD |
netapp hci_baseboard_management_controller netapp:hci_baseboard_management_controller | all versions | NVD |
netapp max_data netapp:max_data | all versions | NVD |
netapp oncommand_insight netapp:oncommand_insight | all versions | NVD |
netapp oncommand_system_manager netapp:oncommand_system_manager | from 3.0 through 3.1.3 | NVD |
netapp snap_creator_framework netapp:snap_creator_framework | all versions | NVD |
netapp snapcenter_server netapp:snapcenter_server | all versions | NVD |
tenable log_correlation_engine tenable:log_correlation_engine | before 6.0.9 | NVD |
References
- https://www.debian.org/security/2020/dsa-4693vendor-advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QPN2L2XVQGUA2V5HNQJWHK3APSK3VN7K/vendor-advisory
- https://www.oracle.com/security-alerts/cpujul2020.html
- https://jquery.com/upgrade-guide/3.5/release-notes, vendor-advisory
- https://security.netapp.com/advisory/ntap-20200511-0006/
- https://www.drupal.org/sa-core-2020-002
- https://github.com/jquery/jquery/security/advisories/GHSA-jpcq-cgw6-v4j6third-party-advisory
- https://blog.jquery.com/2020/04/10/jquery-3-5-0-releasedrelease-notes, vendor-advisory
- http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00067.htmlvendor-advisory, broken-link
- https://security.gentoo.org/glsa/202007-03vendor-advisory
- http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00085.htmlvendor-advisory, broken-link
- https://lists.apache.org/thread.html/r094f435595582f6b5b24b66fedf80543aa8b1d57a3688fbcc21f06ec%40%3Cissues.hive.apache.org%3Emailing-list, issue-tracking
- https://lists.apache.org/thread.html/rf661a90a15da8da5922ba6127b3f5f8194d4ebec8855d60a0dd13248%40%3Cdev.hive.apache.org%3Emailing-list
- https://lists.apache.org/thread.html/r9c5fda81e4bca8daee305b4c03283dddb383ab8428a151d4cb0b3b15%40%3Cissues.hive.apache.org%3Emailing-list
- https://lists.apache.org/thread.html/ra3c9219fcb0b289e18e9ec5a5ebeaa5c17d6b79a201667675af6721c%40%3Cgitbox.hive.apache.org%3Emailing-list
- https://lists.apache.org/thread.html/radcb2aa874a79647789f3563fcbbceaf1045a029ee8806b59812a8ea%40%3Cissues.hive.apache.org%3Emailing-list
- https://lists.apache.org/thread.html/rd38b4185a797b324c8dd940d9213cf99fcdc2dbf1fc5a63ba7dee8c9%40%3Cissues.hive.apache.org%3Emailing-list
- https://lists.apache.org/thread.html/r6e97b37963926f6059ecc1e417721608723a807a76af41d4e9dbed49%40%3Cissues.hive.apache.org%3Emailing-list, issue-tracking
- https://lists.apache.org/thread.html/rb69b7d8217c1a6a2100247a5d06ce610836b31e3f5d73fc113ded8e7%40%3Cissues.hive.apache.org%3Emailing-list
- https://lists.apache.org/thread.html/r4aadb98086ca72ed75391f54167522d91489a0d0ae25b12baa8fc7c5%40%3Cissues.hive.apache.org%3Emailing-list, issue-tracking
- https://lists.apache.org/thread.html/ra374bb0299b4aa3e04edde01ebc03ed6f90cf614dad40dd428ce8f72%40%3Cgitbox.hive.apache.org%3Emailing-list
- https://lists.apache.org/thread.html/rb25c3bc7418ae75cba07988dafe1b6912f76a9dd7d94757878320d61%40%3Cgitbox.hive.apache.org%3Emailing-list
- https://lists.apache.org/thread.html/rf1ba79e564fe7efc56aef7c986106f1cf67a3427d08e997e088e7a93%40%3Cgitbox.hive.apache.org%3Emailing-list
- https://lists.apache.org/thread.html/ra32c7103ded9041c7c1cb8c12c8d125a6b2f3f3270e2937ef8417fac%40%3Cgitbox.hive.apache.org%3Emailing-list
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SFP4UK4EGP4AFH2MWYJ5A5Z4I7XVFQ6B/vendor-advisory
- http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00039.htmlbroken-link, mailing-list, third-party-advisory
- http://packetstormsecurity.com/files/162160/jQuery-1.0.3-Cross-Site-Scripting.htmlexploit, third-party-advisory, vdb-entry
- https://lists.apache.org/thread.html/r0483ba0072783c2e1bfea613984bfb3c86e73ba8879d780dc1cc7d36%40%3Cissues.flink.apache.org%3Eissue-tracking, mailing-list
- https://lists.apache.org/thread.html/r0593393ca1e97b1e7e098fe69d414d6bd0a467148e9138d07e86ebbb%40%3Cissues.hive.apache.org%3Eissue-tracking, mailing-list
- https://lists.apache.org/thread.html/r07ab379471fb15644bf7a92e4a98cbc7df3cf4e736abae0cc7625fe6%40%3Cdev.felix.apache.org%3Eissue-tracking, mailing-list
- https://lists.apache.org/thread.html/r1fed19c860a0d470f2a3eded12795772c8651ff583ef951ddac4918c%40%3Cgitbox.hive.apache.org%3Eissue-tracking, mailing-list
- https://lists.apache.org/thread.html/r2c85121a47442036c7f8353a3724aa04f8ecdfda1819d311ba4f5330%40%3Cdev.felix.apache.org%3Eissue-tracking, mailing-list
- https://lists.apache.org/thread.html/r3702ede0ff83a29ba3eb418f6f11c473d6e3736baba981a8dbd9c9ef%40%3Cdev.felix.apache.org%3Eissue-tracking, mailing-list
- https://lists.apache.org/thread.html/r49ce4243b4738dd763caeb27fa8ad6afb426ae3e8c011ff00b8b1f48%40%3Cissues.flink.apache.org%3Eissue-tracking, mailing-list
- https://lists.apache.org/thread.html/r4dba67be3239b34861f1b9cfdf9dfb3a90272585dcce374112ed6e16%40%3Cdev.felix.apache.org%3Eissue-tracking, mailing-list
- https://lists.apache.org/thread.html/r54565a8f025c7c4f305355fdfd75b68eca442eebdb5f31c2e7d977ae%40%3Cissues.flink.apache.org%3Eissue-tracking, mailing-list
- https://lists.apache.org/thread.html/r55f5e066cc7301e3630ce90bbbf8d28c82212ae1f2d4871012141494%40%3Cdev.felix.apache.org%3Eissue-tracking, mailing-list
- https://lists.apache.org/thread.html/r564585d97bc069137e64f521e68ba490c7c9c5b342df5d73c49a0760%40%3Cissues.flink.apache.org%3Eissue-tracking, mailing-list
- https://lists.apache.org/thread.html/r6c4df3b33e625a44471009a172dabe6865faec8d8f21cac2303463b1%40%3Cissues.hive.apache.org%3Eissue-tracking, mailing-list
- https://lists.apache.org/thread.html/r706cfbc098420f7113968cc377247ec3d1439bce42e679c11c609e2d%40%3Cissues.flink.apache.org%3Eissue-tracking, mailing-list
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.