CVE-2020-11022GHSA-GXR4-XJJ5-5PX2BIT-DRUPAL-2020-11022
jQuery has a potential XSS vulnerability
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 3.5.0, 4.4.0, 1.19.0, 4.0.1
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- 1 on Exploit-DB, 3 proofs of concept on GitHub
Summary
In jQuery starting with 1.12.0 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.
Timeline
- CVE published
- Public exploit on Exploit-DB
EDB-49766
- Record last updated
- EPSS reached 10%
FIRST estimates at least a 10% chance of exploitation in the next 30 days
Affected versions
- jquery jQuery
From 1.12.0 · fixed in 3.5.0
- jquerynpm
From 1.12.0 · fixed in 3.5.0
- jqueryNuGet
From 1.12.0 · fixed in 3.5.0
- jquery-railsRubyGems
fixed in 4.4.0
- org.webjars.npm:jqueryMaven
From 1.12.0 · fixed in 3.5.0
- maximebf/debugbarPackagist
fixed in 1.19.0
- athlon1600/youtube-downloaderPackagist
fixed in 4.0.1
- components/jqueryPackagist
From 1.12.0 · fixed in 3.5.0