CVE-2020-11022 jQuery has a potential XSS vulnerability
An attacker can execute arbitrary JavaScript code by passing untrusted HTML to jQuery DOM manipulation methods, affecting web applications using vulnerable versions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2020-11022?
CVE-2020-11022 is a medium-severity cross-site scripting vulnerability in Debian Debian Linux, published on 29 Apr 2020. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
In jQuery starting with 1.12.0 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.
Weakness: CWE-79
Which versions are affected by CVE-2020-11022?
15 open source packages ship an affected version, including jquery, drupal and org.webjars.npm:jquery. It affects 70 products.
| Package | Affected | Fixed in |
|---|---|---|
jquery NuGet | From 1.12.0 | 3.5.0 |
jquery NuGet | From 1.12.0 | 3.5.0 |
jquery npm | From 1.12.0 | 3.5.0 |
jquery npm | From 1.12.0 | 3.5.0 |
drupal Bitnami | From 7.0.0 | 7.70.0, 8.7.14, 8.8.6 |
org.webjars.npm:jquery Maven | From 1.12.0 | 3.5.0 |
9 more packages
org.webjars.npm:jquery Maven | From 1.12.0 | 3.5.0 |
athlon1600/youtube-downloader Packagist | All versions | 4.0.1 |
athlon1600/youtube-downloader Packagist | All versions | 4.0.1 |
components/jquery Packagist | From 1.12.0 | 3.5.0 |
components/jquery Packagist | From 1.12.0 | 3.5.0 |
maximebf/debugbar Packagist | All versions | 1.19.0 |
maximebf/debugbar Packagist | All versions | 1.19.0 |
jquery-rails RubyGems | All versions | 4.4.0 |
jquery-rails RubyGems | All versions | 4.4.0 |
Linux distribution packages (25)
atomic-openshift-web-console Red Hat:openshift:3.11::el7 | All versions | 0:3.11.219-1.git.1.9b9b889.el7 |
release-notes-susemanager-proxy SUSE:Manager Proxy 3.2 | All versions | 3.2.15-0.16.47.1 |
spacewalk-backend SUSE:Manager Proxy 3.2 | All versions | 2.8.57.23-3.51.1 |
spacewalk-client-tools SUSE:Manager Proxy 3.2 | All versions | 2.8.22.8-3.15.1 |
spacewalk-proxy-installer SUSE:Manager Proxy 3.2 | All versions | 2.8.6.8-3.18.1 |
spacewalk-web SUSE:Manager Proxy 3.2 | All versions | 2.8.7.24-3.48.1 |
zypp-plugin-spacewalk SUSE:Manager Proxy 3.2 | All versions | 1.0.7-3.13.1 |
golang-github-QubitProducts-exporter_exporter SUSE:Manager Proxy Module 4.1 | All versions | 0.4.0-6.3.6 |
mgr-osad SUSE:Manager Proxy Module 4.1 | All versions | 4.1.3-2.3.6 |
patterns-suse-manager SUSE:Manager Proxy Module 4.1 | All versions | 4.1-6.3.6 |
spacecmd SUSE:Manager Proxy Module 4.1 | All versions | 4.1.6-4.3.6 |
spacewalk-backend SUSE:Manager Proxy Module 4.1 | All versions | 4.1.14-4.5.2 |
spacewalk-certs-tools SUSE:Manager Proxy Module 4.1 | All versions | 4.1.12-3.3.6 |
spacewalk-proxy SUSE:Manager Proxy Module 4.1 | All versions | 4.1.2-3.3.6 |
spacewalk-web SUSE:Manager Proxy Module 4.1 | All versions | 4.1.15-3.3.6 |
suseRegisterInfo SUSE:Manager Proxy Module 4.1 | All versions | 4.1.3-4.3.6 |
uyuni-common-libs SUSE:Manager Proxy Module 4.1 | All versions | 4.1.6-3.3.6 |
bind-formula SUSE:Manager Server 3.2 | All versions | 0.1.1584363976.36bce64-3.6.1 |
branch-network-formula SUSE:Manager Server 3.2 | All versions | 0.1.1584363976.36bce64-3.9.1 |
py26-compat-salt SUSE:Manager Server 3.2 | All versions | 2016.11.10-6.38.1 |
python-susemanager-retail SUSE:Manager Server 3.2 | All versions | 1.0.1584363976.36bce64-2.12.1 |
release-notes-susemanager SUSE:Manager Server 3.2 | All versions | 3.2.15-6.61.1 |
spacewalk-backend SUSE:Manager Server 3.2 | All versions | 2.8.57.23-3.51.1 |
spacewalk-client-tools SUSE:Manager Server 3.2 | All versions | 2.8.22.8-3.15.1 |
spacewalk-java SUSE:Manager Server 3.2 | All versions | 2.8.78.29-3.50.1 |
Products include Debian Debian Linux, Drupal Drupal, Fedoraproject Fedora, Jquery Jquery, Netapp H300e Firmware, Netapp H300s Firmware and 64 more.
How do I fix CVE-2020-11022?
Upgrade jquery to 3.5.0 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2020-11022 being exploited?
There is no known exploitation of CVE-2020-11022 in the wild and no public exploit code.
Public exploit code: 1 Exploit-DB entry and 3 proofs of concept on GitHub.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as BIT-drupal-2020-11022, CLEANSTART-2024-SR87769, CLSA-2026-1784596271, CLSA-2026-1792764670, DEBIAN-CVE-2020-11022, GHSA-gxr4-xjj5-5px2 and 6 more.