cbcvebase.
CVE-2020-11023
published 2020-04-29

CVE-2020-11023: In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing elements from untrusted sources - even after sanitizing it - to one…

PriorityP183medium6.1CVSS 3.1
AVNACLPRNUIRSCCLILAN
KEVITWEXPLOIT
CISA Known Exploited Vulnerabilitydue 2025-02-13
Exploited in the wild
EPSS
83.83%
99.7th percentile
In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.

Affected

77 ranges· showing 25
VendorProductVersion rangeFixed in
componentsjquery>= 1.0.3 < 3.5.03.5.0
debiandebian_linux
debiannode-jquery< node-jquery 3.5.0+dfsg-2 (bookworm)node-jquery 3.5.0+dfsg-2 (bookworm)
debianotrs2< node-jquery 3.5.0+dfsg-2 (bookworm)node-jquery 3.5.0+dfsg-2 (bookworm)
drupalcore>= 8.0.0 < 8.7.148.7.14
drupalcore>= 8.8.0 < 8.8.68.8.6
drupaldrupal>= 7.0 < 7.707.70
drupaldrupal>= 8.7.0 < 8.7.148.7.14
drupaldrupal>= 8.8.0 < 8.8.68.8.6
drupaldrupal_core
fedoraprojectfedora
fedoraprojectfedora
fedoraprojectfedora
jqueryjquery
jqueryjquery>= 0 < 1.7.2+dfsg-2ubuntu1+esm11.7.2+dfsg-2ubuntu1+esm1
jqueryjquery>= 0 < 1.11.3+dfsg-4ubuntu0.1~esm11.11.3+dfsg-4ubuntu0.1~esm1
jqueryjquery>= 0 < 3.2.1-1ubuntu0.1~esm13.2.1-1ubuntu0.1~esm1
jqueryjquery>= 1.0.3 < 3.5.03.5.0
jqueryjquery>= 1.0.3 < 3.5.03.5.0
jqueryjquery>= 1.0.3 < 3.5.03.5.0
netapponcommand_system_manager3.0 – 3.1.3
oracleapplication_express< 20.220.2
oracleapplication_testing_suite
oraclebanking_enterprise_collections2.7.0 – 2.8.0
oraclebanking_platform2.4.0 – 2.10.0

Detection & IOCsextracted from sources · hover to see the quote

command<img src=x onerror=alert(1)>
command">
  • Detect use of vulnerable jQuery versions (>= 1.0.3 and < 3.5.0) via browser developer tools or SCA/SAST/DAST scanning tools such as OWASP Dependency-Check
  • Monitor for suspicious scripts executing in the browser's developer console as a client-side indicator of DOM-based XSS exploitation
  • Flag use of jQuery DOM manipulation methods (.html(), .append(), and others) receiving HTML input containing <option>, <select>, or similar elements from untrusted sources
  • Audit web applications for jQuery versions >= 1.0.3 and < 3.5.0; the vulnerability is in the htmlPrefilter function
  • ·Exploitation requires untrusted HTML to be passed to jQuery DOM manipulation methods; environments where user-supplied input is not rendered via these methods are not exploitable
  • ·The Proof of Concept 2 payload (using a closing quote/tag injection) only affects jQuery 3.x, not all versions in the vulnerable range
  • ·DOM-based XSS payloads typically do not touch the server, making server-side logging and detection unreliable for this CVE

CVSS provenance

nvdv3.16.1MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
osv6.1MEDIUM
vulncheck6.9MEDIUM
cisa6.1MEDIUM
vendor_debian6.9MEDIUM
vendor_redhat6.9MEDIUM
vendor_oracle6.1MEDIUM
vendor_ubuntu6.1MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.