CVE-2020-11022

Published Apr 29, 2020

Last updated a month ago

CVSS medium 6.9
lms
Open source

Overview

Description
In jQuery starting with 1.12.0 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.
Source
security-advisories@github.com
NVD status
Modified
Products
jquery, drupal, debian_linux, fedora, agile_product_lifecycle_management_for_process, application_testing_suite, banking_digital_experience, blockchain_platform, communications_application_session_controller, communications_billing_and_revenue_management, communications_diameter_signaling_router_idih\, communications_eagle_application_processor, communications_services_gatekeeper, communications_webrtc_session_controller, enterprise_manager_ops_center, enterprise_session_border_controller, financial_services_analytical_applications_infrastructure, financial_services_analytical_applications_reconciliation_framework, financial_services_asset_liability_management, financial_services_balance_sheet_planning, financial_services_basel_regulatory_capital_basic, financial_services_basel_regulatory_capital_internal_ratings_based_approach, financial_services_data_foundation, financial_services_data_governance_for_us_regulatory_reporting, financial_services_data_integration_hub, financial_services_funds_transfer_pricing, financial_services_hedge_management_and_ifrs_valuations, financial_services_institutional_performance_analytics, financial_services_liquidity_risk_management, financial_services_liquidity_risk_measurement_and_management, financial_services_loan_loss_forecasting_and_provisioning, financial_services_market_risk_measurement_and_management, financial_services_price_creation_and_discovery, financial_services_profitability_management, financial_services_regulatory_reporting_for_european_banking_authority, financial_services_regulatory_reporting_for_us_federal_reserve, healthcare_foundation, hospitality_materials_control, hospitality_simphony, insurance_accounting_analyzer, insurance_allocation_manager_for_enterprise_profitability, insurance_data_foundation, insurance_insbridge_rating_and_underwriting, jdeveloper, peoplesoft_enterprise_peopletools, policy_automation, policy_automation_connector_for_siebel, policy_automation_for_mobile_devices, retail_back_office, retail_customer_management_and_segmentation_foundation, retail_returns_management, siebel_ui_framework, storagetek_acsls, weblogic_server, max_data, oncommand_insight, oncommand_system_manager, snap_creator_framework, snapcenter, h300s_firmware, h500s_firmware, h700s_firmware, h300e_firmware, h500e_firmware, h700e_firmware, h410s_firmware, h410c_firmware, leap, log_correlation_engine, agile_product_supplier_collaboration_for_process

Risk scores

CVSS 3.1

Type
Primary
Base score
6.1
Impact score
2.7
Exploitability score
2.8
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Severity
MEDIUM

CVSS 2.0

Type
Primary
Base score
4.3
Impact score
2.9
Exploitability score
8.6
Vector string
AV:N/AC:M/Au:N/C:N/I:P/A:N

Weaknesses

security-advisories@github.com
CWE-79
nvd@nist.gov
CWE-79

Social media

Hype score
Not currently trending

Configurations

References

Sources include official advisories and independent security research.