Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2020-11022


In jQuery versions greater than or equal to 1.2 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.


Published

2020-04-29T22:15:11.903

Last Modified

2024-11-21T04:56:36.110

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 6.9 (MEDIUM)

CVSSv2 Vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

  • Access Vector: NETWORK
  • Access Complexity: MEDIUM
  • Authentication: NONE
  • Confidentiality Impact: NONE
  • Integrity Impact: PARTIAL
  • Availability Impact: NONE
Exploitability Score

8.6

Impact Score

2.9

Weaknesses
  • Type: Secondary
    CWE-79
  • Type: Primary
    CWE-79

Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application jquery jquery < 3.5.0 Yes
Application drupal drupal < 7.70 Yes
Application drupal drupal < 8.7.14 Yes
Application drupal drupal < 8.8.6 Yes
Operating System debian debian_linux 9.0 Yes
Operating System fedoraproject fedora 31 Yes
Operating System fedoraproject fedora 32 Yes
Operating System fedoraproject fedora 33 Yes
Application oracle agile_product_lifecycle_management_for_process 6.2.0.0 Yes
Application oracle application_testing_suite 13.3.0.1 Yes
Application oracle banking_digital_experience 18.1 Yes
Application oracle banking_digital_experience 18.2 Yes
Application oracle banking_digital_experience 18.3 Yes
Application oracle banking_digital_experience 19.1 Yes
Application oracle banking_digital_experience 19.2 Yes
Application oracle banking_digital_experience 20.1 Yes
Application oracle blockchain_platform < 21.1.2 Yes
Application oracle communications_application_session_controller 3.8m0 Yes
Application oracle communications_billing_and_revenue_management 7.5.0.23.0 Yes
Application oracle communications_billing_and_revenue_management 12.0.0.3.0 Yes
Application oracle communications_diameter_signaling_router_idih\ ≤ 8.2.2 Yes
Application oracle communications_eagle_application_processor ≤ 16.4.0 Yes
Application oracle communications_services_gatekeeper 7.0 Yes
Application oracle communications_webrtc_session_controller 7.2 Yes
Application oracle enterprise_manager_ops_center 12.4.0.0 Yes
Application oracle enterprise_session_border_controller 8.4 Yes
Application oracle financial_services_analytical_applications_infrastructure ≤ 8.1.0.0.0 Yes
Application oracle financial_services_analytical_applications_reconciliation_framework ≤ 8.0.8 Yes
Application oracle financial_services_analytical_applications_reconciliation_framework 8.1.0 Yes
Application oracle financial_services_asset_liability_management 8.0.6 Yes
Application oracle financial_services_asset_liability_management 8.0.7 Yes
Application oracle financial_services_asset_liability_management 8.1.0 Yes
Application oracle financial_services_balance_sheet_planning 8.0.8 Yes
Application oracle financial_services_basel_regulatory_capital_basic ≤ 8.0.8 Yes
Application oracle financial_services_basel_regulatory_capital_basic 8.1.0 Yes
Application oracle financial_services_basel_regulatory_capital_internal_ratings_based_approach ≤ 8.0.8 Yes
Application oracle financial_services_basel_regulatory_capital_internal_ratings_based_approach 8.1.0 Yes
Application oracle financial_services_data_foundation ≤ 8.1.0 Yes
Application oracle financial_services_data_governance_for_us_regulatory_reporting ≤ 8.0.9 Yes
Application oracle financial_services_data_integration_hub 8.0.6 Yes
Application oracle financial_services_data_integration_hub 8.0.7 Yes
Application oracle financial_services_data_integration_hub 8.1.0 Yes
Application oracle financial_services_funds_transfer_pricing 8.0.6 Yes
Application oracle financial_services_funds_transfer_pricing 8.0.7 Yes
Application oracle financial_services_funds_transfer_pricing 8.1.0 Yes
Application oracle financial_services_hedge_management_and_ifrs_valuations ≤ 8.0.8 Yes
Application oracle financial_services_hedge_management_and_ifrs_valuations 8.1.0 Yes
Application oracle financial_services_institutional_performance_analytics 8.0.6 Yes
Application oracle financial_services_institutional_performance_analytics 8.0.7 Yes
Application oracle financial_services_institutional_performance_analytics 8.1.0 Yes
Application oracle financial_services_liquidity_risk_management 8.0.6 Yes
Application oracle financial_services_liquidity_risk_measurement_and_management 8.0.7 Yes
Application oracle financial_services_liquidity_risk_measurement_and_management 8.0.8 Yes
Application oracle financial_services_liquidity_risk_measurement_and_management 8.1.0 Yes
Application oracle financial_services_loan_loss_forecasting_and_provisioning ≤ 8.0.8 Yes
Application oracle financial_services_loan_loss_forecasting_and_provisioning 8.1.0 Yes
Application oracle financial_services_market_risk_measurement_and_management 8.0.6 Yes
Application oracle financial_services_market_risk_measurement_and_management 8.0.8 Yes
Application oracle financial_services_price_creation_and_discovery 8.0.6 Yes
Application oracle financial_services_price_creation_and_discovery 8.0.7 Yes
Application oracle financial_services_profitability_management 8.0.6 Yes
Application oracle financial_services_profitability_management 8.0.7 Yes
Application oracle financial_services_profitability_management 8.1.0 Yes
Application oracle financial_services_regulatory_reporting_for_european_banking_authority ≤ 8.1.0 Yes
Application oracle financial_services_regulatory_reporting_for_us_federal_reserve ≤ 8.0.9 Yes
Application oracle healthcare_foundation 7.1.1 Yes
Application oracle healthcare_foundation 7.2.0 Yes
Application oracle healthcare_foundation 7.2.1 Yes
Application oracle healthcare_foundation 7.3.0 Yes
Application oracle hospitality_materials_control 18.1 Yes
Application oracle hospitality_simphony ≤ 19.1.2 Yes
Application oracle hospitality_simphony 18.1 Yes
Application oracle hospitality_simphony 18.2 Yes
Application oracle insurance_accounting_analyzer 8.0.9 Yes
Application oracle insurance_allocation_manager_for_enterprise_profitability 8.0.8 Yes
Application oracle insurance_allocation_manager_for_enterprise_profitability 8.1.0 Yes
Application oracle insurance_data_foundation ≤ 8.1.0 Yes
Application oracle insurance_insbridge_rating_and_underwriting ≤ 5.6.0.0 Yes
Application oracle insurance_insbridge_rating_and_underwriting 5.6.1.0 Yes
Application oracle jdeveloper 11.1.1.9.0 Yes
Application oracle jdeveloper 12.2.1.3.0 Yes
Application oracle jdeveloper 12.2.1.4.0 Yes
Application oracle peoplesoft_enterprise_peopletools 8.56 Yes
Application oracle peoplesoft_enterprise_peopletools 8.57 Yes
Application oracle peoplesoft_enterprise_peopletools 8.58 Yes
Application oracle policy_automation ≤ 12.2.20 Yes
Application oracle policy_automation_connector_for_siebel 10.4.6 Yes
Application oracle policy_automation_for_mobile_devices ≤ 12.2.20 Yes
Application oracle retail_back_office 14.0 Yes
Application oracle retail_back_office 14.1 Yes
Application oracle retail_customer_management_and_segmentation_foundation 19.0 Yes
Application oracle retail_returns_management 14.0 Yes
Application oracle retail_returns_management 14.1 Yes
Application oracle siebel_ui_framework 20.8 Yes
Application oracle storagetek_acsls 8.5.1 Yes
Application oracle weblogic_server 10.3.6.0.0 Yes
Application oracle weblogic_server 12.1.3.0.0 Yes
Application oracle weblogic_server 12.2.1.3.0 Yes
Application oracle weblogic_server 12.2.1.4.0 Yes
Application oracle weblogic_server 14.1.1.0.0 Yes
Application netapp max_data - Yes
Application netapp oncommand_insight - Yes
Application netapp oncommand_system_manager ≤ 3.1.3 Yes
Application netapp snap_creator_framework - Yes
Application netapp snapcenter - Yes
Operating System netapp h300s_firmware - Yes
Hardware netapp h300s - No
Operating System netapp h500s_firmware - Yes
Hardware netapp h500s - No
Operating System netapp h700s_firmware - Yes
Hardware netapp h700s - No
Operating System netapp h300e_firmware - Yes
Hardware netapp h300e - No
Operating System netapp h500e_firmware - Yes
Hardware netapp h500e - No
Operating System netapp h700e_firmware - Yes
Hardware netapp h700e - No
Operating System netapp h410s_firmware - Yes
Hardware netapp h410s - No
Operating System netapp h410c_firmware - Yes
Hardware netapp h410c - No
Operating System opensuse leap 15.1 Yes
Operating System opensuse leap 15.2 Yes
Application tenable log_correlation_engine < 6.0.9 Yes
Application oracle agile_product_supplier_collaboration_for_process 6.2.0.0 Yes
Application oracle banking_digital_experience ≤ 20.1 Yes
Application oracle communications_application_session_controller 3.8m0 Yes
Application oracle communications_billing_and_revenue_management 7.5.0.23.0 Yes
Application oracle communications_billing_and_revenue_management 12.0.0.3.0 Yes
Application oracle communications_diameter_signaling_router_idih\ ≤ 8.2.2 Yes
Application oracle communications_webrtc_session_controller 7.2 Yes
Application oracle enterprise_manager_ops_center 12.4.0.0 Yes
Application oracle enterprise_session_border_controller 8.4 Yes
Application oracle financial_services_analytical_applications_infrastructure ≤ 8.1.0 Yes
Application oracle financial_services_analytical_applications_reconciliation_framework ≤ 8.0.8 Yes
Application oracle financial_services_analytical_applications_reconciliation_framework 8.1.0 Yes
Application oracle financial_services_asset_liability_management 8.0.6 Yes
Application oracle financial_services_asset_liability_management 8.0.7 Yes
Application oracle financial_services_asset_liability_management 8.1.0 Yes
Application oracle financial_services_balance_sheet_planning 8.0.8 Yes
Application oracle financial_services_basel_regulatory_capital_basic ≤ 8.0.8 Yes
Application oracle financial_services_basel_regulatory_capital_basic 8.1.0 Yes
Application oracle financial_services_basel_regulatory_capital_internal_ratings_based_approach ≤ 8.0.8 Yes
Application oracle financial_services_basel_regulatory_capital_internal_ratings_based_approach 8.1.0 Yes
Application oracle financial_services_data_foundation ≤ 8.1.0 Yes
Application oracle financial_services_data_governance_for_us_regulatory_reporting ≤ 8.0.9 Yes
Application oracle financial_services_data_integration_hub 8.0.6 Yes
Application oracle financial_services_data_integration_hub 8.0.7 Yes
Application oracle financial_services_data_integration_hub 8.1.0 Yes
Application oracle financial_services_funds_transfer_pricing 8.0.6 Yes
Application oracle financial_services_funds_transfer_pricing 8.0.7 Yes
Application oracle financial_services_funds_transfer_pricing 8.1.0 Yes
Application oracle financial_services_hedge_management_and_ifrs_valuations ≤ 8.0.8 Yes
Application oracle financial_services_hedge_management_and_ifrs_valuations 8.1.0 Yes
Application oracle financial_services_institutional_performance_analytics 8.0.6 Yes
Application oracle financial_services_institutional_performance_analytics 8.0.7 Yes
Application oracle financial_services_institutional_performance_analytics 8.1.0 Yes
Application oracle financial_services_liquidity_risk_management 8.0.6 Yes
Application oracle financial_services_liquidity_risk_measurement_and_management 8.0.7 Yes
Application oracle financial_services_liquidity_risk_measurement_and_management 8.0.8 Yes
Application oracle financial_services_liquidity_risk_measurement_and_management 8.1.0 Yes
Application oracle financial_services_loan_loss_forecasting_and_provisioning ≤ 8.0.8 Yes
Application oracle financial_services_loan_loss_forecasting_and_provisioning 8.1.0 Yes
Application oracle financial_services_market_risk_measurement_and_management 8.0.6 Yes
Application oracle financial_services_market_risk_measurement_and_management 8.0.8 Yes
Application oracle financial_services_price_creation_and_discovery 8.0.6 Yes
Application oracle financial_services_price_creation_and_discovery 8.0.7 Yes
Application oracle financial_services_profitability_management 8.0.6 Yes
Application oracle financial_services_profitability_management 8.0.7 Yes
Application oracle financial_services_profitability_management 8.1.0 Yes
Application oracle financial_services_regulatory_reporting_for_european_banking_authority ≤ 8.1.0 Yes
Application oracle financial_services_regulatory_reporting_for_us_federal_reserve ≤ 8.0.9 Yes
Application oracle healthcare_foundation 7.1.1 Yes
Application oracle healthcare_foundation 7.2.0 Yes
Application oracle healthcare_foundation 7.2.1 Yes
Application oracle healthcare_foundation 7.3.0 Yes
Application oracle hospitality_materials_control 18.1 Yes
Application oracle hospitality_simphony 18.1 Yes
Application oracle hospitality_simphony 18.2 Yes
Application oracle hospitality_simphony 19.1.0-19.1.2 Yes
Application oracle insurance_accounting_analyzer 8.0.9 Yes
Application oracle insurance_allocation_manager_for_enterprise_profitability 8.0.8 Yes
Application oracle insurance_allocation_manager_for_enterprise_profitability 8.1.0 Yes
Application oracle insurance_data_foundation 8.0.6-8.1.0 Yes
Application oracle insurance_insbridge_rating_and_underwriting ≤ 5.6.0.0 Yes
Application oracle insurance_insbridge_rating_and_underwriting 5.6.1.0 Yes
Application oracle jdeveloper 11.1.1.9.0 Yes
Application oracle jdeveloper 12.2.1.3.0 Yes
Application oracle jdeveloper 12.2.1.4.0 Yes
Application oracle peoplesoft_enterprise_peopletools 8.56 Yes
Application oracle peoplesoft_enterprise_peopletools 8.57 Yes
Application oracle peoplesoft_enterprise_peopletools 8.58 Yes
Application oracle policy_automation ≤ 12.2.20 Yes
Application oracle policy_automation_connector_for_siebel 10.4.6 Yes
Application oracle policy_automation_for_mobile_devices ≤ 12.2.20 Yes
Application oracle retail_back_office 14.0 Yes
Application oracle retail_back_office 14.1 Yes
Application oracle retail_customer_management_and_segmentation_foundation 19.0 Yes
Application oracle retail_returns_management 14.0 Yes
Application oracle retail_returns_management 14.1 Yes
Application oracle siebel_ui_framework 20.8 Yes
Application oracle weblogic_server 10.3.6.0.0 Yes
Application oracle weblogic_server 12.1.3.0.0 Yes
Application oracle weblogic_server 12.2.1.3.0 Yes
Application oracle weblogic_server 12.2.1.4.0 Yes
Application oracle weblogic_server 14.1.1.0.0 Yes

References