Description
In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.
Published: 2020-04-29
Score: 6.9 Medium
EPSS: 43.9% Moderate
KEV: Yes
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-2608-1 jquery security update
Debian DLA Debian DLA DLA-3551-1 otrs2 security update
Debian DSA Debian DSA DSA-4693-1 drupal7 security update
Github GHSA Github GHSA GHSA-jpcq-cgw6-v4j6 Potential XSS vulnerability in jQuery
Ubuntu USN Ubuntu USN USN-7246-1 jQuery vulnerabilities
Ubuntu USN Ubuntu USN USN-7622-1 jQuery vulnerabilities
Ubuntu USN Ubuntu USN USN-7658-1 Drupal vulnerabilities
References
Link Providers
http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00067.html cve-icon cve-icon
http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00085.html cve-icon cve-icon
http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00039.html cve-icon cve-icon
http://packetstormsecurity.com/files/162160/jQuery-1.0.3-Cross-Site-Scripting.html cve-icon cve-icon
https://blog.jquery.com/2020/04/10/jquery-3-5-0-released cve-icon cve-icon
https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/ cve-icon
https://github.com/github/advisory-database/blob/99afa6fdeaf5d1d23e1021ff915a5e5dbc82c1f1/advisories/github-reviewed/2020/04/GHSA-jpcq-cgw6-v4j6/GHSA-jpcq-cgw6-v4j6.json#L20-L37 cve-icon
https://github.com/jquery/jquery/security/advisories/GHSA-jpcq-cgw6-v4j6 cve-icon cve-icon
https://jquery.com/upgrade-guide/3.5/ cve-icon cve-icon
https://lists.apache.org/thread.html/r0483ba0072783c2e1bfea613984bfb3c86e73ba8879d780dc1cc7d36%40%3Cissues.flink.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/r0593393ca1e97b1e7e098fe69d414d6bd0a467148e9138d07e86ebbb%40%3Cissues.hive.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/r07ab379471fb15644bf7a92e4a98cbc7df3cf4e736abae0cc7625fe6%40%3Cdev.felix.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/r094f435595582f6b5b24b66fedf80543aa8b1d57a3688fbcc21f06ec%40%3Cissues.hive.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/r1fed19c860a0d470f2a3eded12795772c8651ff583ef951ddac4918c%40%3Cgitbox.hive.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/r2c85121a47442036c7f8353a3724aa04f8ecdfda1819d311ba4f5330%40%3Cdev.felix.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/r3702ede0ff83a29ba3eb418f6f11c473d6e3736baba981a8dbd9c9ef%40%3Cdev.felix.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/r49ce4243b4738dd763caeb27fa8ad6afb426ae3e8c011ff00b8b1f48%40%3Cissues.flink.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/r4aadb98086ca72ed75391f54167522d91489a0d0ae25b12baa8fc7c5%40%3Cissues.hive.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/r4dba67be3239b34861f1b9cfdf9dfb3a90272585dcce374112ed6e16%40%3Cdev.felix.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/r54565a8f025c7c4f305355fdfd75b68eca442eebdb5f31c2e7d977ae%40%3Cissues.flink.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/r55f5e066cc7301e3630ce90bbbf8d28c82212ae1f2d4871012141494%40%3Cdev.felix.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/r564585d97bc069137e64f521e68ba490c7c9c5b342df5d73c49a0760%40%3Cissues.flink.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/r6c4df3b33e625a44471009a172dabe6865faec8d8f21cac2303463b1%40%3Cissues.hive.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/r6e97b37963926f6059ecc1e417721608723a807a76af41d4e9dbed49%40%3Cissues.hive.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/r706cfbc098420f7113968cc377247ec3d1439bce42e679c11c609e2d%40%3Cissues.flink.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/r8f70b0f65d6bedf316ecd899371fd89e65333bc988f6326d2956735c%40%3Cissues.flink.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/r9006ad2abf81d02a0ef2126bab5177987e59095b7194a487c4ea247c%40%3Ccommits.felix.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/r9c5fda81e4bca8daee305b4c03283dddb383ab8428a151d4cb0b3b15%40%3Cissues.hive.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/r9e0bd31b7da9e7403478d22652b8760c946861f8ebd7bd750844898e%40%3Cdev.felix.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/ra32c7103ded9041c7c1cb8c12c8d125a6b2f3f3270e2937ef8417fac%40%3Cgitbox.hive.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/ra374bb0299b4aa3e04edde01ebc03ed6f90cf614dad40dd428ce8f72%40%3Cgitbox.hive.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/ra3c9219fcb0b289e18e9ec5a5ebeaa5c17d6b79a201667675af6721c%40%3Cgitbox.hive.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/ra406b3adfcffcb5ce8707013bdb7c35e3ffc2776a8a99022f15274c6%40%3Cissues.hive.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/rab82dd040f302018c85bd07d33f5604113573514895ada523c3401d9%40%3Ccommits.hive.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/radcb2aa874a79647789f3563fcbbceaf1045a029ee8806b59812a8ea%40%3Cissues.hive.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/rb25c3bc7418ae75cba07988dafe1b6912f76a9dd7d94757878320d61%40%3Cgitbox.hive.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/rb69b7d8217c1a6a2100247a5d06ce610836b31e3f5d73fc113ded8e7%40%3Cissues.hive.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/rbb448222ba62c430e21e13f940be4cb5cfc373cd3bce56b48c0ffa67%40%3Cdev.flink.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/rd38b4185a797b324c8dd940d9213cf99fcdc2dbf1fc5a63ba7dee8c9%40%3Cissues.hive.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/rda99599896c3667f2cc9e9d34c7b6ef5d2bbed1f4801e1d75a2b0679%40%3Ccommits.nifi.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/re4ae96fa5c1a2fe71ccbb7b7ac1538bd0cb677be270a2bf6e2f8d108%40%3Cissues.flink.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/rede9cfaa756e050a3d83045008f84a62802fc68c17f2b4eabeaae5e4%40%3Cissues.flink.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/ree3bd8ddb23df5fa4e372d11c226830ea3650056b1059f3965b3fce2%40%3Cissues.flink.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/rf0f8939596081d84be1ae6a91d6248b96a02d8388898c372ac807817%40%3Cdev.felix.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/rf1ba79e564fe7efc56aef7c986106f1cf67a3427d08e997e088e7a93%40%3Cgitbox.hive.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/rf661a90a15da8da5922ba6127b3f5f8194d4ebec8855d60a0dd13248%40%3Cdev.hive.apache.org%3E cve-icon cve-icon
https://lists.debian.org/debian-lts-announce/2021/03/msg00033.html cve-icon cve-icon
https://lists.debian.org/debian-lts-announce/2023/08/msg00040.html cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AVKYXLWCLZBV2N7M46KYK4LVA5OXWPBY/ cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QPN2L2XVQGUA2V5HNQJWHK3APSK3VN7K/ cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SAPQVX3XDNPGFT26QAQ6AJIXZZBZ4CD4/ cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SFP4UK4EGP4AFH2MWYJ5A5Z4I7XVFQ6B/ cve-icon cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2020-11023 cve-icon
https://security.gentoo.org/glsa/202007-03 cve-icon cve-icon
https://security.netapp.com/advisory/ntap-20200511-0006/ cve-icon cve-icon
https://www.cisa.gov/known-exploited-vulnerabilities-catalog cve-icon
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-11023 cve-icon cve-icon
https://www.cve.org/CVERecord?id=CVE-2020-11023 cve-icon
https://www.debian.org/security/2020/dsa-4693 cve-icon cve-icon
https://www.drupal.org/sa-core-2020-002 cve-icon cve-icon
https://www.oracle.com//security-alerts/cpujul2021.html cve-icon cve-icon
https://www.oracle.com/security-alerts/cpuApr2021.html cve-icon cve-icon
https://www.oracle.com/security-alerts/cpuapr2022.html cve-icon cve-icon
https://www.oracle.com/security-alerts/cpujan2021.html cve-icon cve-icon
https://www.oracle.com/security-alerts/cpujan2022.html cve-icon cve-icon
https://www.oracle.com/security-alerts/cpujul2020.html cve-icon cve-icon
https://www.oracle.com/security-alerts/cpujul2022.html cve-icon cve-icon
https://www.oracle.com/security-alerts/cpuoct2020.html cve-icon cve-icon
https://www.oracle.com/security-alerts/cpuoct2021.html cve-icon cve-icon
https://www.tenable.com/security/tns-2021-02 cve-icon cve-icon
https://www.tenable.com/security/tns-2021-10 cve-icon cve-icon
History

Wed, 22 Oct 2025 00:15:00 +0000

Type Values Removed Values Added
References

Tue, 21 Oct 2025 20:30:00 +0000

Type Values Removed Values Added
References

Tue, 21 Oct 2025 19:30:00 +0000

Type Values Removed Values Added
References

Fri, 18 Apr 2025 02:15:00 +0000

Type Values Removed Values Added
First Time appeared Redhat quay
CPEs cpe:/a:redhat:quay:3::el8
Vendors & Products Redhat quay

Fri, 04 Apr 2025 20:15:00 +0000

Type Values Removed Values Added
First Time appeared Netapp active Iq Unified Manager
Netapp cloud Backup
Netapp cloud Insights Storage Workload Security Agent
Netapp hci Baseboard Management Controller
Oracle blockchain Platform
CPEs cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:linux:*:*
cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vsphere:*:*
cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:*
cpe:2.3:a:netapp:cloud_backup:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:cloud_insights_storage_workload_security_agent:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:hci_baseboard_management_controller:-:*:*:*:*:*:*:*
cpe:2.3:a:oracle:blockchain_platform:*:*:*:*:*:*:*:*
cpe:2.3:a:oracle:blockchain_platform:21.1.2:*:*:*:*:*:*:*
Vendors & Products Netapp active Iq Unified Manager
Netapp cloud Backup
Netapp cloud Insights Storage Workload Security Agent
Netapp hci Baseboard Management Controller
Oracle blockchain Platform

Thu, 06 Mar 2025 02:00:00 +0000

Type Values Removed Values Added
First Time appeared Redhat logging
CPEs cpe:/a:redhat:logging:5.8::el8
Vendors & Products Redhat logging

Thu, 13 Feb 2025 02:45:00 +0000

Type Values Removed Values Added
CPEs cpe:/o:redhat:enterprise_linux:9

Thu, 13 Feb 2025 00:00:00 +0000

Type Values Removed Values Added
First Time appeared Redhat discovery
Redhat rhel Aus
Redhat rhel E4s
Redhat rhel Els
Redhat rhel Eus
Redhat rhel Tus
CPEs cpe:/a:redhat:enterprise_linux:8::crb
cpe:/a:redhat:enterprise_linux:9
cpe:/a:redhat:enterprise_linux:9::crb
cpe:/a:redhat:openstack:16.2::el8
cpe:/a:redhat:rhel_aus:8.2
cpe:/a:redhat:rhel_aus:8.4
cpe:/a:redhat:rhel_aus:8.6
cpe:/a:redhat:rhel_e4s:8.4
cpe:/a:redhat:rhel_e4s:8.6
cpe:/a:redhat:rhel_e4s:9.0
cpe:/a:redhat:rhel_eus:8.8
cpe:/a:redhat:rhel_eus:8.8::crb
cpe:/a:redhat:rhel_eus:9.2
cpe:/a:redhat:rhel_eus:9.2::crb
cpe:/a:redhat:rhel_eus:9.4
cpe:/a:redhat:rhel_eus:9.4::crb
cpe:/a:redhat:rhel_tus:8.4
cpe:/a:redhat:rhel_tus:8.6
cpe:/o:redhat:discovery:1.0::el9
cpe:/o:redhat:enterprise_linux:8
cpe:/o:redhat:rhel_aus:7.7
cpe:/o:redhat:rhel_els:7
Vendors & Products Redhat discovery
Redhat rhel Aus
Redhat rhel E4s
Redhat rhel Els
Redhat rhel Eus
Redhat rhel Tus
References

Mon, 10 Feb 2025 19:15:00 +0000

Type Values Removed Values Added
Metrics kev

{'dateAdded': '2025-01-23'}

Thu, 23 Jan 2025 21:30:00 +0000

Type Values Removed Values Added
References

Thu, 23 Jan 2025 18:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'active', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Subscriptions

Debian Debian Linux
Drupal Drupal
Fedoraproject Fedora
Jquery Jquery
Netapp Active Iq Unified Manager Cloud Backup Cloud Insights Storage Workload Security Agent H300e H300e Firmware H300s H300s Firmware H410c H410c Firmware H410s H410s Firmware H500e H500e Firmware H500s H500s Firmware H700e H700e Firmware H700s H700s Firmware Hci Baseboard Management Controller Max Data Oncommand Insight Oncommand System Manager Snap Creator Framework Snapcenter Server
Oracle Application Express Application Testing Suite Banking Enterprise Collections Banking Platform Blockchain Platform Business Intelligence Communications Analytics Communications Eagle Application Processor Communications Element Manager Communications Interactive Session Recorder Communications Operations Monitor Communications Services Gatekeeper Communications Session Report Manager Communications Session Route Manager Financial Services Regulatory Reporting For De Nederlandsche Bank Financial Services Revenue Management And Billing Analytics Health Sciences Inform Healthcare Translational Research Hyperion Financial Reporting Jd Edwards Enterpriseone Orchestrator Jd Edwards Enterpriseone Tools Oss Support Tools Peoplesoft Enterprise Human Capital Management Resources Primavera Gateway Rest Data Services Siebel Mobile Storagetek Acsls Storagetek Tape Analytics Sw Tool Webcenter Sites Weblogic Server
Redhat Amq Interconnect Ansible Tower Discovery Enterprise Linux Jboss Enterprise Application Platform Jboss Single Sign On Logging Openshift Openstack Quay Red Hat Single Sign On Rhel Aus Rhel E4s Rhel Els Rhel Eus Rhel Tus Rhev Manager Service Mesh
Tenable Log Correlation Engine
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2025-10-21T23:35:45.230Z

Reserved: 2020-03-30T00:00:00.000Z

Link: CVE-2020-11023

cve-icon Vulnrichment

Updated: 2025-01-23T21:07:47.681Z

cve-icon NVD

Status : Analyzed

Published: 2020-04-29T21:15:11.743

Modified: 2025-11-07T19:32:52.023

Link: CVE-2020-11023

cve-icon Redhat

Severity : Moderate

Publid Date: 2020-04-29T00:00:00Z

Links: CVE-2020-11023 - Bugzilla

cve-icon OpenCVE Enrichment

No data.

Weaknesses