CVE
CVE-2020-11023
- First Reported
- Oct 21, 2026
- Latest Reported
- Oct 21, 2026
CVE Enrichment
- CVSS
- 6.1 MEDIUM
- EPSS
- 84.89%
- EPSS Percentile
- 99.71%
- CISA KEV
- YES — Known Exploited Vulnerability
Description
In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.
Technical Details
- CVSS Version
- 3.1
- CNA / NVD Source
- [email protected]
- Published
- 30-Apr-2020 04:15
- Last Modified
- 17-Jun-2026 09:48
- EPSS Date
- 2026-10-20
- CWE
- CWE-79
CVSS Vector
CVSS:3.1 AV:N /
AC:L /
PR:N /
UI:R /
S:C /
C:L /
I:L /
A:N
CISA KEV Details
- Date Added
- 2025-01-23
- Remediation Due
- 2025-02-13
- Known Ransomware Campaign Use
- Unknown
- Required Action
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Notes
- This vulnerability could affect an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https://github.com/jquery/jquery/security/advisories/GHSA-jpcq-cgw6-v4j6 ; https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/ ; https://nvd.nist.gov/vuln/detail/CVE-2020-11023
Affected Products / Versions
- jquery / jquery
Version / affected range: * · from (inclusive) 1.0.3 · before (exclusive) 3.5.0
cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:* - debian / debian_linux
Version / affected range: 9.0
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* - fedoraproject / fedora
Version / affected range: 31
cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:* - fedoraproject / fedora
Version / affected range: 32
cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:* - fedoraproject / fedora
Version / affected range: 33
cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* - drupal / drupal
Version / affected range: * · from (inclusive) 7.0 · before (exclusive) 7.70
cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:* - drupal / drupal
Version / affected range: * · from (inclusive) 8.7.0 · before (exclusive) 8.7.14
cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:* - drupal / drupal
Version / affected range: * · from (inclusive) 8.8.0 · before (exclusive) 8.8.6
cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:* - oracle / application_express
Version / affected range: * · before (exclusive) 20.2
cpe:2.3:a:oracle:application_express:*:*:*:*:*:*:*:* - oracle / application_testing_suite
Version / affected range: 13.3.0.1
cpe:2.3:a:oracle:application_testing_suite:13.3.0.1:*:*:*:*:*:*:* - oracle / banking_enterprise_collections
Version / affected range: * · from (inclusive) 2.7.0 · through (inclusive) 2.8.0
cpe:2.3:a:oracle:banking_enterprise_collections:*:*:*:*:*:*:*:* - oracle / banking_platform
Version / affected range: * · from (inclusive) 2.4.0 · through (inclusive) 2.10.0
cpe:2.3:a:oracle:banking_platform:*:*:*:*:*:*:*:* - oracle / blockchain_platform
Version / affected range: * · before (exclusive) 21.1.2
cpe:2.3:a:oracle:blockchain_platform:*:*:*:*:*:*:*:* - oracle / blockchain_platform
Version / affected range: 21.1.2
cpe:2.3:a:oracle:blockchain_platform:21.1.2:*:*:*:*:*:*:* - oracle / business_intelligence
Version / affected range: 5.9.0.0.0
cpe:2.3:a:oracle:business_intelligence:5.9.0.0.0:*:*:*:enterprise:*:*:* - oracle / communications_analytics
Version / affected range: 12.1.1
cpe:2.3:a:oracle:communications_analytics:12.1.1:*:*:*:*:*:*:* - oracle / communications_eagle_application_processor
Version / affected range: * · from (inclusive) 16.1.0 · through (inclusive) 16.4.0
cpe:2.3:a:oracle:communications_eagle_application_processor:*:*:*:*:*:*:*:* - oracle / communications_element_manager
Version / affected range: 8.1.1
cpe:2.3:a:oracle:communications_element_manager:8.1.1:*:*:*:*:*:*:* - oracle / communications_element_manager
Version / affected range: 8.2.0
cpe:2.3:a:oracle:communications_element_manager:8.2.0:*:*:*:*:*:*:* - oracle / communications_element_manager
Version / affected range: 8.2.1
cpe:2.3:a:oracle:communications_element_manager:8.2.1:*:*:*:*:*:*:* - oracle / communications_interactive_session_recorder
Version / affected range: * · from (inclusive) 6.1 · through (inclusive) 6.4
cpe:2.3:a:oracle:communications_interactive_session_recorder:*:*:*:*:*:*:*:* - oracle / communications_operations_monitor
Version / affected range: * · from (inclusive) 4.1 · through (inclusive) 4.3
cpe:2.3:a:oracle:communications_operations_monitor:*:*:*:*:*:*:*:* - oracle / communications_operations_monitor
Version / affected range: 3.4
cpe:2.3:a:oracle:communications_operations_monitor:3.4:*:*:*:*:*:*:* - oracle / communications_services_gatekeeper
Version / affected range: 7.0
cpe:2.3:a:oracle:communications_services_gatekeeper:7.0:*:*:*:*:*:*:* - oracle / communications_session_report_manager
Version / affected range: 8.1.1
cpe:2.3:a:oracle:communications_session_report_manager:8.1.1:*:*:*:*:*:*:* - oracle / communications_session_report_manager
Version / affected range: 8.2.0
cpe:2.3:a:oracle:communications_session_report_manager:8.2.0:*:*:*:*:*:*:* - oracle / communications_session_report_manager
Version / affected range: 8.2.1
cpe:2.3:a:oracle:communications_session_report_manager:8.2.1:*:*:*:*:*:*:* - oracle / communications_session_route_manager
Version / affected range: 8.1.1
cpe:2.3:a:oracle:communications_session_route_manager:8.1.1:*:*:*:*:*:*:* - oracle / communications_session_route_manager
Version / affected range: 8.2.0
cpe:2.3:a:oracle:communications_session_route_manager:8.2.0:*:*:*:*:*:*:* - oracle / communications_session_route_manager
Version / affected range: 8.2.1
cpe:2.3:a:oracle:communications_session_route_manager:8.2.1:*:*:*:*:*:*:* - oracle / financial_services_regulatory_reporting_for_de_nederlandsche_bank
Version / affected range: 8.0.4
cpe:2.3:a:oracle:financial_services_regulatory_reporting_for_de_nederlandsche_bank:8.0.4:*:*:*:*:*:*:* - oracle / financial_services_revenue_management_and_billing_analytics
Version / affected range: 2.7
cpe:2.3:a:oracle:financial_services_revenue_management_and_billing_analytics:2.7:*:*:*:*:*:*:* - oracle / financial_services_revenue_management_and_billing_analytics
Version / affected range: 2.8
cpe:2.3:a:oracle:financial_services_revenue_management_and_billing_analytics:2.8:*:*:*:*:*:*:* - oracle / health_sciences_inform
Version / affected range: 6.3.0
cpe:2.3:a:oracle:health_sciences_inform:6.3.0:*:*:*:*:*:*:* - oracle / healthcare_translational_research
Version / affected range: 3.2.1
cpe:2.3:a:oracle:healthcare_translational_research:3.2.1:*:*:*:*:*:*:* - oracle / healthcare_translational_research
Version / affected range: 3.3.1
cpe:2.3:a:oracle:healthcare_translational_research:3.3.1:*:*:*:*:*:*:* - oracle / healthcare_translational_research
Version / affected range: 3.3.2
cpe:2.3:a:oracle:healthcare_translational_research:3.3.2:*:*:*:*:*:*:* - oracle / healthcare_translational_research
Version / affected range: 3.4.0
cpe:2.3:a:oracle:healthcare_translational_research:3.4.0:*:*:*:*:*:*:* - oracle / hyperion_financial_reporting
Version / affected range: 11.1.2.4
cpe:2.3:a:oracle:hyperion_financial_reporting:11.1.2.4:*:*:*:*:*:*:* - oracle / jd_edwards_enterpriseone_orchestrator
Version / affected range: * · before (exclusive) 9.2.5.0
cpe:2.3:a:oracle:jd_edwards_enterpriseone_orchestrator:*:*:*:*:*:*:*:* - oracle / jd_edwards_enterpriseone_tools
Version / affected range: * · before (exclusive) 9.2.5.0
cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:*:*:*:*:*:*:*:* - oracle / oss_support_tools
Version / affected range: * · before (exclusive) 2.12.41
cpe:2.3:a:oracle:oss_support_tools:*:*:*:*:*:*:*:* - oracle / peoplesoft_enterprise_human_capital_management_resources
Version / affected range: 9.2
cpe:2.3:a:oracle:peoplesoft_enterprise_human_capital_management_resources:9.2:*:*:*:*:*:*:* - oracle / primavera_gateway
Version / affected range: * · from (inclusive) 16.2 · through (inclusive) 16.2.11
cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:* - oracle / primavera_gateway
Version / affected range: * · from (inclusive) 17.12.0 · through (inclusive) 17.12.7
cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:* - oracle / primavera_gateway
Version / affected range: * · from (inclusive) 18.8.0 · through (inclusive) 18.8.9
cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:* - oracle / primavera_gateway
Version / affected range: * · from (inclusive) 19.12.0 · through (inclusive) 19.12.4
cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:* - oracle / rest_data_services
Version / affected range: 11.2.0.4
cpe:2.3:a:oracle:rest_data_services:11.2.0.4:*:*:*:-:*:*:* - oracle / rest_data_services
Version / affected range: 12.1.0.2
cpe:2.3:a:oracle:rest_data_services:12.1.0.2:*:*:*:-:*:*:* - oracle / rest_data_services
Version / affected range: 12.2.0.1
cpe:2.3:a:oracle:rest_data_services:12.2.0.1:*:*:*:-:*:*:* - oracle / rest_data_services
Version / affected range: 18c
cpe:2.3:a:oracle:rest_data_services:18c:*:*:*:-:*:*:* - oracle / rest_data_services
Version / affected range: 19c
cpe:2.3:a:oracle:rest_data_services:19c:*:*:*:-:*:*:* - oracle / siebel_mobile
Version / affected range: * · through (inclusive) 20.12
cpe:2.3:a:oracle:siebel_mobile:*:*:*:*:*:*:*:* - oracle / storagetek_acsls
Version / affected range: 8.5.1
cpe:2.3:a:oracle:storagetek_acsls:8.5.1:*:*:*:*:*:*:* - oracle / storagetek_tape_analytics_sw_tool
Version / affected range: 2.3.1
cpe:2.3:a:oracle:storagetek_tape_analytics_sw_tool:2.3.1:*:*:*:*:*:*:* - oracle / webcenter_sites
Version / affected range: 12.2.1.3.0
cpe:2.3:a:oracle:webcenter_sites:12.2.1.3.0:*:*:*:*:*:*:* - oracle / webcenter_sites
Version / affected range: 12.2.1.4.0
cpe:2.3:a:oracle:webcenter_sites:12.2.1.4.0:*:*:*:*:*:*:* - oracle / weblogic_server
Version / affected range: 12.1.3.0.0
cpe:2.3:a:oracle:weblogic_server:12.1.3.0.0:*:*:*:*:*:*:* - oracle / weblogic_server
Version / affected range: 12.2.1.3.0
cpe:2.3:a:oracle:weblogic_server:12.2.1.3.0:*:*:*:*:*:*:* - oracle / weblogic_server
Version / affected range: 12.2.1.4.0
cpe:2.3:a:oracle:weblogic_server:12.2.1.4.0:*:*:*:*:*:*:* - oracle / weblogic_server
Version / affected range: 14.1.1.0.0
cpe:2.3:a:oracle:weblogic_server:14.1.1.0.0:*:*:*:*:*:*:* - netapp / h300s_firmware
Version / affected range: -
cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:* - netapp / h500s_firmware
Version / affected range: -
cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:* - netapp / h700s_firmware
Version / affected range: -
cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:* - netapp / h300e_firmware
Version / affected range: -
cpe:2.3:o:netapp:h300e_firmware:-:*:*:*:*:*:*:* - netapp / h500e_firmware
Version / affected range: -
cpe:2.3:o:netapp:h500e_firmware:-:*:*:*:*:*:*:* - netapp / h700e_firmware
Version / affected range: -
cpe:2.3:o:netapp:h700e_firmware:-:*:*:*:*:*:*:* - netapp / h410s_firmware
Version / affected range: -
cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:* - netapp / h410c_firmware
Version / affected range: -
cpe:2.3:o:netapp:h410c_firmware:-:*:*:*:*:*:*:* - netapp / active_iq_unified_manager
Version / affected range: -
cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:linux:*:* - netapp / active_iq_unified_manager
Version / affected range: -
cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vsphere:*:* - netapp / active_iq_unified_manager
Version / affected range: -
cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:* - netapp / cloud_backup
Version / affected range: -
cpe:2.3:a:netapp:cloud_backup:-:*:*:*:*:*:*:* - netapp / cloud_insights_storage_workload_security_agent
Version / affected range: -
cpe:2.3:a:netapp:cloud_insights_storage_workload_security_agent:-:*:*:*:*:*:*:* - netapp / hci_baseboard_management_controller
Version / affected range: -
cpe:2.3:a:netapp:hci_baseboard_management_controller:-:*:*:*:*:*:*:* - netapp / max_data
Version / affected range: -
cpe:2.3:a:netapp:max_data:-:*:*:*:*:*:*:* - netapp / oncommand_insight
Version / affected range: -
cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:* - netapp / oncommand_system_manager
Version / affected range: * · from (inclusive) 3.0 · through (inclusive) 3.1.3
cpe:2.3:a:netapp:oncommand_system_manager:*:*:*:*:*:*:*:* - netapp / snap_creator_framework
Version / affected range: -
cpe:2.3:a:netapp:snap_creator_framework:-:*:*:*:*:*:*:* - netapp / snapcenter_server
Version / affected range: -
cpe:2.3:a:netapp:snapcenter_server:-:*:*:*:*:*:*:* - tenable / log_correlation_engine
Version / affected range: * · before (exclusive) 6.0.9
cpe:2.3:a:tenable:log_correlation_engine:*:*:*:*:*:*:*:*
References
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- CISA Advisory
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.
Reported Context (1)
- | | | 4 BDSA-2020-0964 (CVE-2020-11023) | 791 | 2,594 | 28% | Black Duck 2026 Report Finds Open Source Vulnerability Counts More Than Doubled
CVE (5)
Malware (1)
Threat Actors (1)
MITRE ATT&CK (5)
Vendors (1)
Products (6)
Industries (9)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.