JQuery · JQuery
CVE-2020-11023
Potential XSS vulnerability in jQuery
De quoi s'agit-il
In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.
CISA: JQuery contains a persistent cross-site scripting (XSS) vulnerability. When passing maliciously formed, untrusted input enclosed in HTML tags, JQuery's DOM manipulators can execute untrusted code in the context of the user's browser.
Que faire
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Échéance pour les agences fédérales américaines : 13 février 2025
- Ajoutée à la liste de la CISA
- 23 janvier 2025
- Publiée
- 29 avril 2020
- Gravité
- Moyenne 6,9 CVSS 3.1
- Probabilité d'attaques dans les 30 prochains jours (EPSS)
- 85% dans les 0,3% les plus à risque de toutes les failles connues
- Faiblesse
- CWE-79
- Plus de détails
- NVD · CVE.org · CISA
Toutes les références (20)
- https://www.debian.org/security/2020/dsa-4693
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QPN2L2XVQGUA…
- http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00067.html
- https://security.gentoo.org/glsa/202007-03
- http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00085.html
- https://www.oracle.com/security-alerts/cpujul2020.html
- https://jquery.com/upgrade-guide/3.5/
- https://security.netapp.com/advisory/ntap-20200511-0006/
- https://www.drupal.org/sa-core-2020-002
- https://github.com/jquery/jquery/security/advisories/GHSA-jpcq-cgw6-v4j6
- https://blog.jquery.com/2020/04/10/jquery-3-5-0-released
- https://lists.apache.org/thread.html/r094f435595582f6b5b24b66fedf80543aa8b1d57a3688fbcc21f06ec%40%3Cissues.hi…
- https://lists.apache.org/thread.html/rf661a90a15da8da5922ba6127b3f5f8194d4ebec8855d60a0dd13248%40%3Cdev.hive.…
- https://lists.apache.org/thread.html/r9c5fda81e4bca8daee305b4c03283dddb383ab8428a151d4cb0b3b15%40%3Cissues.hi…
- https://lists.apache.org/thread.html/ra3c9219fcb0b289e18e9ec5a5ebeaa5c17d6b79a201667675af6721c%40%3Cgitbox.hi…
- https://lists.apache.org/thread.html/radcb2aa874a79647789f3563fcbbceaf1045a029ee8806b59812a8ea%40%3Cissues.hi…
- https://lists.apache.org/thread.html/rd38b4185a797b324c8dd940d9213cf99fcdc2dbf1fc5a63ba7dee8c9%40%3Cissues.hi…
- https://lists.apache.org/thread.html/r6e97b37963926f6059ecc1e417721608723a807a76af41d4e9dbed49%40%3Cissues.hi…
- https://lists.apache.org/thread.html/rb69b7d8217c1a6a2100247a5d06ce610836b31e3f5d73fc113ded8e7%40%3Cissues.hi…
- https://lists.apache.org/thread.html/r4aadb98086ca72ed75391f54167522d91489a0d0ae25b12baa8fc7c5%40%3Cissues.hi…
Sources : Known Exploited Vulnerabilities (CISA, domaine public), CVE records (cve.org) et EPSS (FIRST). Le risque d'attaque est l'estimation EPSS qu'une personne tente d'exploiter la faille dans les 30 prochains jours.