In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.

Project Subscriptions

Vendors Products
Debian Linux Subscribe
Fedoraproject Subscribe
Active Iq Unified Manager Subscribe
Cloud Backup Subscribe
Cloud Insights Storage Workload Security Agent Subscribe
H300e Firmware Subscribe
H300s Firmware Subscribe
H410c Firmware Subscribe
H410s Firmware Subscribe
H500e Firmware Subscribe
H500s Firmware Subscribe
H700e Firmware Subscribe
H700s Firmware Subscribe
Hci Baseboard Management Controller Subscribe
Max Data Subscribe
Oncommand Insight Subscribe
Oncommand System Manager Subscribe
Snap Creator Framework Subscribe
Snapcenter Server Subscribe
Application Express Subscribe
Application Testing Suite Subscribe
Banking Enterprise Collections Subscribe
Banking Platform Subscribe
Blockchain Platform Subscribe
Business Intelligence Subscribe
Communications Analytics Subscribe
Communications Eagle Application Processor Subscribe
Communications Element Manager Subscribe
Communications Interactive Session Recorder Subscribe
Communications Operations Monitor Subscribe
Communications Services Gatekeeper Subscribe
Communications Session Report Manager Subscribe
Communications Session Route Manager Subscribe
Financial Services Regulatory Reporting For De Nederlandsche Bank Subscribe
Financial Services Revenue Management And Billing Analytics Subscribe
Health Sciences Inform Subscribe
Healthcare Translational Research Subscribe
Hyperion Financial Reporting Subscribe
Jd Edwards Enterpriseone Orchestrator Subscribe
Jd Edwards Enterpriseone Tools Subscribe
Oss Support Tools Subscribe
Peoplesoft Enterprise Human Capital Management Resources Subscribe
Primavera Gateway Subscribe
Rest Data Services Subscribe
Siebel Mobile Subscribe
Storagetek Acsls Subscribe
Storagetek Tape Analytics Sw Tool Subscribe
Webcenter Sites Subscribe
Weblogic Server Subscribe
Amq Interconnect Subscribe
Ansible Tower Subscribe
Discovery Subscribe
Enterprise Linux Subscribe
Jboss Enterprise Application Platform Subscribe
Jboss Single Sign On Subscribe
Logging Subscribe
Openshift Subscribe
Openstack Subscribe
Red Hat Single Sign On Subscribe
Rhel Aus Subscribe
Rhel E4s Subscribe
Rhel Els Subscribe
Rhel Eus Subscribe
Rhel Tus Subscribe
Rhev Manager Subscribe
Service Mesh Subscribe
Tenable Subscribe
Log Correlation Engine Subscribe
Advisories
Source ID Title
Debian DLA Debian DLA DLA-2608-1 jquery security update
Debian DLA Debian DLA DLA-3551-1 otrs2 security update
Debian DSA Debian DSA DSA-4693-1 drupal7 security update
Github GHSA Github GHSA GHSA-jpcq-cgw6-v4j6 Potential XSS vulnerability in jQuery
Ubuntu USN Ubuntu USN USN-7246-1 jQuery vulnerabilities
Ubuntu USN Ubuntu USN USN-7622-1 jQuery vulnerabilities
Ubuntu USN Ubuntu USN USN-7658-1 Drupal vulnerabilities
Fixes

Solution

No solution given by the vendor.


Workaround

No workaround given by the vendor.

References
Link Providers
http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00067.html cve-icon cve-icon
http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00085.html cve-icon cve-icon
http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00039.html cve-icon cve-icon
http://packetstormsecurity.com/files/162160/jQuery-1.0.3-Cross-Site-Scripting.html cve-icon cve-icon
https://blog.jquery.com/2020/04/10/jquery-3-5-0-released cve-icon cve-icon
https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/ cve-icon
https://github.com/github/advisory-database/blob/99afa6fdeaf5d1d23e1021ff915a5e5dbc82c1f1/advisories/github-reviewed/2020/04/GHSA-jpcq-cgw6-v4j6/GHSA-jpcq-cgw6-v4j6.json#L20-L37 cve-icon
https://github.com/jquery/jquery/security/advisories/GHSA-jpcq-cgw6-v4j6 cve-icon cve-icon
https://jquery.com/upgrade-guide/3.5/ cve-icon cve-icon
https://lists.apache.org/thread.html/r0483ba0072783c2e1bfea613984bfb3c86e73ba8879d780dc1cc7d36%40%3Cissues.flink.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/r0593393ca1e97b1e7e098fe69d414d6bd0a467148e9138d07e86ebbb%40%3Cissues.hive.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/r07ab379471fb15644bf7a92e4a98cbc7df3cf4e736abae0cc7625fe6%40%3Cdev.felix.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/r094f435595582f6b5b24b66fedf80543aa8b1d57a3688fbcc21f06ec%40%3Cissues.hive.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/r1fed19c860a0d470f2a3eded12795772c8651ff583ef951ddac4918c%40%3Cgitbox.hive.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/r2c85121a47442036c7f8353a3724aa04f8ecdfda1819d311ba4f5330%40%3Cdev.felix.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/r3702ede0ff83a29ba3eb418f6f11c473d6e3736baba981a8dbd9c9ef%40%3Cdev.felix.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/r49ce4243b4738dd763caeb27fa8ad6afb426ae3e8c011ff00b8b1f48%40%3Cissues.flink.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/r4aadb98086ca72ed75391f54167522d91489a0d0ae25b12baa8fc7c5%40%3Cissues.hive.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/r4dba67be3239b34861f1b9cfdf9dfb3a90272585dcce374112ed6e16%40%3Cdev.felix.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/r54565a8f025c7c4f305355fdfd75b68eca442eebdb5f31c2e7d977ae%40%3Cissues.flink.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/r55f5e066cc7301e3630ce90bbbf8d28c82212ae1f2d4871012141494%40%3Cdev.felix.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/r564585d97bc069137e64f521e68ba490c7c9c5b342df5d73c49a0760%40%3Cissues.flink.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/r6c4df3b33e625a44471009a172dabe6865faec8d8f21cac2303463b1%40%3Cissues.hive.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/r6e97b37963926f6059ecc1e417721608723a807a76af41d4e9dbed49%40%3Cissues.hive.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/r706cfbc098420f7113968cc377247ec3d1439bce42e679c11c609e2d%40%3Cissues.flink.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/r8f70b0f65d6bedf316ecd899371fd89e65333bc988f6326d2956735c%40%3Cissues.flink.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/r9006ad2abf81d02a0ef2126bab5177987e59095b7194a487c4ea247c%40%3Ccommits.felix.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/r9c5fda81e4bca8daee305b4c03283dddb383ab8428a151d4cb0b3b15%40%3Cissues.hive.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/r9e0bd31b7da9e7403478d22652b8760c946861f8ebd7bd750844898e%40%3Cdev.felix.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/ra32c7103ded9041c7c1cb8c12c8d125a6b2f3f3270e2937ef8417fac%40%3Cgitbox.hive.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/ra374bb0299b4aa3e04edde01ebc03ed6f90cf614dad40dd428ce8f72%40%3Cgitbox.hive.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/ra3c9219fcb0b289e18e9ec5a5ebeaa5c17d6b79a201667675af6721c%40%3Cgitbox.hive.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/ra406b3adfcffcb5ce8707013bdb7c35e3ffc2776a8a99022f15274c6%40%3Cissues.hive.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/rab82dd040f302018c85bd07d33f5604113573514895ada523c3401d9%40%3Ccommits.hive.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/radcb2aa874a79647789f3563fcbbceaf1045a029ee8806b59812a8ea%40%3Cissues.hive.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/rb25c3bc7418ae75cba07988dafe1b6912f76a9dd7d94757878320d61%40%3Cgitbox.hive.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/rb69b7d8217c1a6a2100247a5d06ce610836b31e3f5d73fc113ded8e7%40%3Cissues.hive.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/rbb448222ba62c430e21e13f940be4cb5cfc373cd3bce56b48c0ffa67%40%3Cdev.flink.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/rd38b4185a797b324c8dd940d9213cf99fcdc2dbf1fc5a63ba7dee8c9%40%3Cissues.hive.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/rda99599896c3667f2cc9e9d34c7b6ef5d2bbed1f4801e1d75a2b0679%40%3Ccommits.nifi.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/re4ae96fa5c1a2fe71ccbb7b7ac1538bd0cb677be270a2bf6e2f8d108%40%3Cissues.flink.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/rede9cfaa756e050a3d83045008f84a62802fc68c17f2b4eabeaae5e4%40%3Cissues.flink.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/ree3bd8ddb23df5fa4e372d11c226830ea3650056b1059f3965b3fce2%40%3Cissues.flink.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/rf0f8939596081d84be1ae6a91d6248b96a02d8388898c372ac807817%40%3Cdev.felix.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/rf1ba79e564fe7efc56aef7c986106f1cf67a3427d08e997e088e7a93%40%3Cgitbox.hive.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/rf661a90a15da8da5922ba6127b3f5f8194d4ebec8855d60a0dd13248%40%3Cdev.hive.apache.org%3E cve-icon cve-icon
https://lists.debian.org/debian-lts-announce/2021/03/msg00033.html cve-icon cve-icon
https://lists.debian.org/debian-lts-announce/2023/08/msg00040.html cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AVKYXLWCLZBV2N7M46KYK4LVA5OXWPBY/ cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QPN2L2XVQGUA2V5HNQJWHK3APSK3VN7K/ cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SAPQVX3XDNPGFT26QAQ6AJIXZZBZ4CD4/ cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SFP4UK4EGP4AFH2MWYJ5A5Z4I7XVFQ6B/ cve-icon cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2020-11023 cve-icon
https://security.gentoo.org/glsa/202007-03 cve-icon cve-icon
https://security.netapp.com/advisory/ntap-20200511-0006/ cve-icon cve-icon
https://www.cisa.gov/known-exploited-vulnerabilities-catalog cve-icon
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-11023 cve-icon cve-icon
https://www.cve.org/CVERecord?id=CVE-2020-11023 cve-icon
https://www.debian.org/security/2020/dsa-4693 cve-icon cve-icon
https://www.drupal.org/sa-core-2020-002 cve-icon cve-icon
https://www.oracle.com//security-alerts/cpujul2021.html cve-icon cve-icon
https://www.oracle.com/security-alerts/cpuApr2021.html cve-icon cve-icon
https://www.oracle.com/security-alerts/cpuapr2022.html cve-icon cve-icon
https://www.oracle.com/security-alerts/cpujan2021.html cve-icon cve-icon
https://www.oracle.com/security-alerts/cpujan2022.html cve-icon cve-icon
https://www.oracle.com/security-alerts/cpujul2020.html cve-icon cve-icon
https://www.oracle.com/security-alerts/cpujul2022.html cve-icon cve-icon
https://www.oracle.com/security-alerts/cpuoct2020.html cve-icon cve-icon
https://www.oracle.com/security-alerts/cpuoct2021.html cve-icon cve-icon
https://www.tenable.com/security/tns-2021-02 cve-icon cve-icon
https://www.tenable.com/security/tns-2021-10 cve-icon cve-icon
History

Wed, 22 Oct 2025 00:15:00 +0000


Tue, 21 Oct 2025 20:30:00 +0000


Tue, 21 Oct 2025 19:30:00 +0000


Fri, 18 Apr 2025 02:15:00 +0000

Type Values Removed Values Added
First Time appeared Redhat quay
CPEs cpe:/a:redhat:quay:3::el8
Vendors & Products Redhat quay

Fri, 04 Apr 2025 20:15:00 +0000

Type Values Removed Values Added
First Time appeared Netapp active Iq Unified Manager
Netapp cloud Backup
Netapp cloud Insights Storage Workload Security Agent
Netapp hci Baseboard Management Controller
Oracle blockchain Platform
CPEs cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:linux:*:*
cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vsphere:*:*
cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:*
cpe:2.3:a:netapp:cloud_backup:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:cloud_insights_storage_workload_security_agent:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:hci_baseboard_management_controller:-:*:*:*:*:*:*:*
cpe:2.3:a:oracle:blockchain_platform:*:*:*:*:*:*:*:*
cpe:2.3:a:oracle:blockchain_platform:21.1.2:*:*:*:*:*:*:*
Vendors & Products Netapp active Iq Unified Manager
Netapp cloud Backup
Netapp cloud Insights Storage Workload Security Agent
Netapp hci Baseboard Management Controller
Oracle blockchain Platform

Thu, 06 Mar 2025 02:00:00 +0000

Type Values Removed Values Added
First Time appeared Redhat logging
CPEs cpe:/a:redhat:logging:5.8::el8
Vendors & Products Redhat logging

Thu, 13 Feb 2025 02:45:00 +0000

Type Values Removed Values Added
CPEs cpe:/o:redhat:enterprise_linux:9

Thu, 13 Feb 2025 00:00:00 +0000

Type Values Removed Values Added
First Time appeared Redhat discovery
Redhat rhel Aus
Redhat rhel E4s
Redhat rhel Els
Redhat rhel Eus
Redhat rhel Tus
CPEs cpe:/a:redhat:enterprise_linux:8::crb
cpe:/a:redhat:enterprise_linux:9
cpe:/a:redhat:enterprise_linux:9::crb
cpe:/a:redhat:openstack:16.2::el8
cpe:/a:redhat:rhel_aus:8.2
cpe:/a:redhat:rhel_aus:8.4
cpe:/a:redhat:rhel_aus:8.6
cpe:/a:redhat:rhel_e4s:8.4
cpe:/a:redhat:rhel_e4s:8.6
cpe:/a:redhat:rhel_e4s:9.0
cpe:/a:redhat:rhel_eus:8.8
cpe:/a:redhat:rhel_eus:8.8::crb
cpe:/a:redhat:rhel_eus:9.2
cpe:/a:redhat:rhel_eus:9.2::crb
cpe:/a:redhat:rhel_eus:9.4
cpe:/a:redhat:rhel_eus:9.4::crb
cpe:/a:redhat:rhel_tus:8.4
cpe:/a:redhat:rhel_tus:8.6
cpe:/o:redhat:discovery:1.0::el9
cpe:/o:redhat:enterprise_linux:8
cpe:/o:redhat:rhel_aus:7.7
cpe:/o:redhat:rhel_els:7
Vendors & Products Redhat discovery
Redhat rhel Aus
Redhat rhel E4s
Redhat rhel Els
Redhat rhel Eus
Redhat rhel Tus
References

Mon, 10 Feb 2025 19:15:00 +0000

Type Values Removed Values Added
Metrics kev

{'dateAdded': '2025-01-23'}


Thu, 23 Jan 2025 21:30:00 +0000


Thu, 23 Jan 2025 18:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'active', 'Technical Impact': 'partial'}, 'version': '2.0.3'}


Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2025-10-21T23:35:45.230Z

Reserved: 2020-03-30T00:00:00.000Z

Link: CVE-2020-11023

cve-icon Vulnrichment

Updated: 2025-01-23T21:07:47.681Z

cve-icon NVD

Status : Analyzed

Published: 2020-04-29T21:15:11.743

Modified: 2025-11-07T19:32:52.023

Link: CVE-2020-11023

cve-icon Redhat

Severity : Moderate

Publid Date: 2020-04-29T00:00:00Z

Links: CVE-2020-11023 - Bugzilla

cve-icon OpenCVE Enrichment

No data.

Weaknesses