CVE-2020-11023
critical-risk
Published 2020-04-29
In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.
Do I need to act?
!
36.3% chance of exploitation in next 30 days
EPSS score — higher than 64% of all CVEs
!
CISA KEV: actively exploited in the wild
On the Known Exploited Vulnerabilities catalog — federal agencies must patch
!
1 public exploit available
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
6
CVSS 6.9/10
Medium
NETWORK
/ HIGH complexity
Affected Products (20)
Communications Eagle Application Processor
References (132)
Release Notes
https://blog.jquery.com/2020/04/10/jquery-3-5-0-released
Third Party Advisory
https://github.com/jquery/jquery/security/advisories/GHSA-jpcq-cgw6-v4j6
Release Notes
https://jquery.com/upgrade-guide/3.5/
and 112 more references
72
/ 100
critical-risk
Severity
21/34 · High
Exploitability
23/34 · High
Exposure
28/34 · Critical