CVE-2020-11023 JQuery Cross-Site Scripting (XSS)
Attackers can execute arbitrary JavaScript by passing unsanitized HTML with option elements to jQuery DOM manipulation methods.
- Exploited in the wild
- Since 23 Jan 2025
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2020-11023?
CVE-2020-11023 is a medium-severity cross-site scripting vulnerability in Debian Debian Linux, published on 29 Apr 2020. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.
Weakness: CWE-79
Which versions are affected by CVE-2020-11023?
11 open source packages ship an affected version, including org.webjars.npm:jquery, drupal and jQuery. It affects 52 products.
| Package | Affected | Fixed in |
|---|---|---|
org.webjars.npm:jquery Maven | From 1.0.3 | 3.5.0 |
org.webjars.npm:jquery Maven | From 1.0.3 | 3.5.0 |
drupal Bitnami | From 7.0.0 | 7.70.0, 8.7.14, 8.8.6 |
jQuery NuGet | From 1.0.3 | 3.5.0 |
jQuery NuGet | From 1.0.3 | 3.5.0 |
components/jquery Packagist | From 1.0.3 | 3.5.0 |
5 more packages
components/jquery Packagist | From 1.0.3 | 3.5.0 |
jquery-rails RubyGems | All versions | 4.4.0 |
jquery-rails RubyGems | All versions | 4.4.0 |
jquery npm | From 1.0.3 | 3.5.0 |
jquery npm | From 1.0.3 | 3.5.0 |
Linux distribution packages (29)
bind-dyndb-ldap AlmaLinux:8 | All versions | 11.6-2.module_el8.5.0+2603+92118e57 |
cpp AlmaLinux:8 | All versions | 8.5.0-23.el8_10.alma.1 |
custodia AlmaLinux:8 | All versions | 0.6.0-3.module_el8.5.0+2603+92118e57 |
custodia AlmaLinux:8 | All versions | 0.6.0-3.module_el8.6.0+2881+2f24dc92 |
doxygen AlmaLinux:8 | All versions | 1:1.8.14-13.el8_10 |
doxygen-doxywizard AlmaLinux:8 | All versions | 1:1.8.14-13.el8_10 |
doxygen-latex AlmaLinux:8 | All versions | 1:1.8.14-13.el8_10 |
gcc AlmaLinux:8 | All versions | 8.5.0-23.el8_10.alma.1 |
gcc-c++ AlmaLinux:8 | All versions | 8.5.0-23.el8_10.alma.1 |
gcc-gdb-plugin AlmaLinux:8 | All versions | 8.5.0-23.el8_10.alma.1 |
gcc-gfortran AlmaLinux:8 | All versions | 8.5.0-23.el8_10.alma.1 |
gcc-offload-nvptx AlmaLinux:8 | All versions | 8.5.0-23.el8_10.alma.1 |
gcc-plugin-annobin AlmaLinux:8 | All versions | 8.5.0-23.el8_10.alma.1 |
gcc-plugin-devel AlmaLinux:8 | All versions | 8.5.0-23.el8_10.alma.1 |
gcc-toolset-13-gcc AlmaLinux:8 | All versions | 13.3.1-2.2.el8_10 |
gcc-toolset-13-gcc-c++ AlmaLinux:8 | All versions | 13.3.1-2.2.el8_10 |
gcc-toolset-13-gcc-gfortran AlmaLinux:8 | All versions | 13.3.1-2.2.el8_10 |
gcc-toolset-13-gcc-plugin-annobin AlmaLinux:8 | All versions | 13.3.1-2.2.el8_10 |
gcc-toolset-13-gcc-plugin-devel AlmaLinux:8 | All versions | 13.3.1-2.2.el8_10 |
gcc-toolset-13-libasan-devel AlmaLinux:8 | All versions | 13.3.1-2.2.el8_10 |
gcc-toolset-13-libatomic-devel AlmaLinux:8 | All versions | 13.3.1-2.2.el8_10 |
gcc-toolset-13-libgccjit AlmaLinux:8 | All versions | 13.3.1-2.2.el8_10 |
gcc-toolset-13-libgccjit-devel AlmaLinux:8 | All versions | 13.3.1-2.2.el8_10 |
gcc-toolset-13-libitm-devel AlmaLinux:8 | All versions | 13.3.1-2.2.el8_10 |
gcc-toolset-13-liblsan-devel AlmaLinux:8 | All versions | 13.3.1-2.2.el8_10 |
gcc-toolset-13-libquadmath-devel AlmaLinux:8 | All versions | 13.3.1-2.2.el8_10 |
gcc-toolset-13-libstdc++-devel AlmaLinux:8 | All versions | 13.3.1-2.2.el8_10 |
gcc-toolset-13-libstdc++-docs AlmaLinux:8 | All versions | 13.3.1-2.2.el8_10 |
gcc-toolset-13-libtsan-devel AlmaLinux:8 | All versions | 13.3.1-2.2.el8_10 |
Products include Debian Debian Linux, Drupal Drupal, Fedoraproject Fedora, Jquery Jquery, Netapp Active Iq Unified Manager, Netapp Cloud Backup and 46 more.
How do I fix CVE-2020-11023?
Upgrade org.webjars.npm:jquery to 3.5.0 or later. US federal agencies must fix it by 13 Feb 2025.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2020-11023 being exploited?
Yes. Attackers have exploited CVE-2020-11023 in the wild since at least 23 Jan 2025.
Public exploit code: 1 Exploit-DB entry and 6 proofs of concept on GitHub.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as ALSA-2021:1846, ALSA-2025:1210, ALSA-2025:1215, ALSA-2025:1300, ALSA-2025:1301, ALSA-2025:1306 and 70 more.