CVE-2020-11022
Published: 29 April 2020
In jQuery versions greater than or equal to 1.2 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.
Priority
Low
CVSS 3 base score: 6.1
Status
| Package | Release | Status |
|---|---|---|
|
drupal7 Launchpad, Ubuntu, Debian |
bionic |
Does not exist
|
| focal |
Does not exist
|
|
| groovy |
Does not exist
|
|
| hirsute |
Does not exist
|
|
| impish |
Does not exist
|
|
| jammy |
Does not exist
|
|
| precise |
Does not exist
|
|
| trusty |
Does not exist
|
|
| upstream |
Needs triage
|
|
| xenial |
Ignored
(end of standard support, was needs-triage)
|
|
|
jquery Launchpad, Ubuntu, Debian |
bionic |
Needs triage
|
| eoan |
Ignored
(reached end-of-life)
|
|
| focal |
Needs triage
|
|
| groovy |
Does not exist
|
|
| hirsute |
Does not exist
|
|
| impish |
Does not exist
|
|
| jammy |
Does not exist
|
|
| precise |
Not vulnerable
(code not present)
|
|
| trusty |
Not vulnerable
(code not present)
|
|
| upstream |
Needs triage
|
|
| xenial |
Needs triage
|
Notes
| Author | Note |
|---|---|
| mdeslaur | This is likely an intrusive, backwards-incompatible change that may break existing software. |
References
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11022
- https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/
- https://github.com/jquery/jquery/security/advisories/GHSA-gxr4-xjj5-5px2
- https://jquery.com/upgrade-guide/3.5/
- NVD
- Launchpad
- Debian