{"cve_id":"CVE-2020-11022","published":"2020-04-29T22:15:11.903000+00:00","last_modified":"2026-06-17T02:48:52.607000+00:00","vuln_status":"Modified","description":"In jQuery starting with 1.12.0 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.","cvss_version":"3.1","cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","base_score":6.1,"base_severity":"MEDIUM","attack_vector":"NETWORK","privileges_req":"NONE","user_interaction":"REQUIRED","scope":"CHANGED","impact_c":"LOW","impact_i":"LOW","impact_a":"NONE","cwe_ids":["CWE-79"],"in_kev":false,"kev_date_added":null,"kev_ransomware":false,"epss_score":0.99215,"epss_percentile":0.99935,"cap_rule_version":"0.1.1","stage":"CRED_ACCESS","req_access":"NONE","req_vector":"NETWORK","req_user_interaction":true,"grant_access":"NONE","caps":["CRED_ACCESS","INFO_DISCLOSURE","TAMPER"],"terminal":false,"cap_confidence":"high","ingested_at":"2026-09-18T09:17:16.024437+00:00","first_seen":"2020-04-29T22:15:11.903000+00:00","kev_first_seen":null,"novelty_score":0.0,"novelty_reasons":[],"novelty_at":null,"vendors":["debian","drupal","fedoraproject","jquery","netapp","opensuse","oracle","tenable"],"products":["agile_product_lifecycle_management_for_process","agile_product_supplier_collaboration_for_process","application_testing_suite","banking_digital_experience","blockchain_platform","communications_application_session_controller","communications_billing_and_revenue_management","communications_diameter_signaling_router_idih\\","communications_eagle_application_processor","communications_services_gatekeeper","communications_webrtc_session_controller","debian_linux","drupal","enterprise_manager_ops_center","enterprise_session_border_controller","fedora","financial_services_analytical_applications_infrastructure","financial_services_analytical_applications_reconciliation_framework","financial_services_asset_liability_management","financial_services_balance_sheet_planning","financial_services_basel_regulatory_capital_basic","financial_services_basel_regulatory_capital_internal_ratings_based_approach","financial_services_data_foundation","financial_services_data_governance_for_us_regulatory_reporting","financial_services_data_integration_hub","financial_services_funds_transfer_pricing","financial_services_hedge_management_and_ifrs_valuations","financial_services_institutional_performance_analytics","financial_services_liquidity_risk_management","financial_services_liquidity_risk_measurement_and_management","financial_services_loan_loss_forecasting_and_provisioning","financial_services_market_risk_measurement_and_management","financial_services_price_creation_and_discovery","financial_services_profitability_management","financial_services_regulatory_reporting_for_european_banking_authority","financial_services_regulatory_reporting_for_us_federal_reserve","h300e","h300e_firmware","h300s","h300s_firmware","h410c","h410c_firmware","h410s","h410s_firmware","h500e","h500e_firmware","h500s","h500s_firmware","h700e","h700e_firmware","h700s","h700s_firmware","healthcare_foundation","hospitality_materials_control","hospitality_simphony","insurance_accounting_analyzer","insurance_allocation_manager_for_enterprise_profitability","insurance_data_foundation","insurance_insbridge_rating_and_underwriting","jdeveloper","jquery","leap","log_correlation_engine","max_data","oncommand_insight","oncommand_system_manager","peoplesoft_enterprise_peopletools","policy_automation","policy_automation_connector_for_siebel","policy_automation_for_mobile_devices","retail_back_office","retail_customer_management_and_segmentation_foundation","retail_returns_management","siebel_ui_framework","snap_creator_framework","snapcenter","storagetek_acsls","weblogic_server"],"affected":[{"vendor":"debian","product":"debian_linux","ranges":["9.0"]},{"vendor":"drupal","product":"drupal","ranges":["≥ 8.8.0 and < 8.8.6","≥ 7.0 and < 7.70","≥ 8.7.0 and < 8.7.14"]},{"vendor":"fedoraproject","product":"fedora","ranges":["31","32","33"]},{"vendor":"jquery","product":"jquery","ranges":["≥ 1.2 and < 3.5.0"]},{"vendor":"netapp","product":"h300e_firmware","ranges":["all versions"]},{"vendor":"netapp","product":"h300s_firmware","ranges":["all versions"]},{"vendor":"netapp","product":"h410c_firmware","ranges":["all versions"]},{"vendor":"netapp","product":"h410s_firmware","ranges":["all versions"]},{"vendor":"netapp","product":"h500e_firmware","ranges":["all versions"]},{"vendor":"netapp","product":"h500s_firmware","ranges":["all versions"]},{"vendor":"netapp","product":"h700e_firmware","ranges":["all versions"]},{"vendor":"netapp","product":"h700s_firmware","ranges":["all versions"]},{"vendor":"netapp","product":"max_data","ranges":["all versions"]},{"vendor":"netapp","product":"oncommand_insight","ranges":["all versions"]},{"vendor":"netapp","product":"oncommand_system_manager","ranges":["≥ 3.0 and ≤ 3.1.3"]},{"vendor":"netapp","product":"snap_creator_framework","ranges":["all versions"]},{"vendor":"netapp","product":"snapcenter","ranges":["all versions"]},{"vendor":"opensuse","product":"leap","ranges":["15.1","15.2"]},{"vendor":"oracle","product":"agile_product_lifecycle_management_for_process","ranges":["6.2.0.0"]},{"vendor":"oracle","product":"agile_product_supplier_collaboration_for_process","ranges":["6.2.0.0"]},{"vendor":"oracle","product":"application_testing_suite","ranges":["13.3.0.1"]},{"vendor":"oracle","product":"banking_digital_experience","ranges":["18.2","18.1","18.3","19.1","19.2","20.1","≥ 18.1 and ≤ 20.1"]},{"vendor":"oracle","product":"blockchain_platform","ranges":["< 21.1.2"]},{"vendor":"oracle","product":"communications_application_session_controller","ranges":["3.8m0"]},{"vendor":"oracle","product":"communications_billing_and_revenue_management","ranges":["7.5.0.23.0","12.0.0.3.0"]},{"vendor":"oracle","product":"communications_diameter_signaling_router_idih\\","ranges":["≥ 8.0.0 and ≤ 8.2.2"]},{"vendor":"oracle","product":"communications_eagle_application_processor","ranges":["≥ 16.1.0 and ≤ 16.4.0"]},{"vendor":"oracle","product":"communications_services_gatekeeper","ranges":["7.0"]},{"vendor":"oracle","product":"communications_webrtc_session_controller","ranges":["7.2"]},{"vendor":"oracle","product":"enterprise_manager_ops_center","ranges":["12.4.0.0"]},{"vendor":"oracle","product":"enterprise_session_border_controller","ranges":["8.4"]},{"vendor":"oracle","product":"financial_services_analytical_applications_infrastructure","ranges":["≥ 8.0.6.0.0 and ≤ 8.1.0.0.0","≥ 8.0.6 and ≤ 8.1.0"]},{"vendor":"oracle","product":"financial_services_analytical_applications_reconciliation_framework","ranges":["8.1.0","≥ 8.0.6 and ≤ 8.0.8"]},{"vendor":"oracle","product":"financial_services_asset_liability_management","ranges":["8.0.6","8.0.7","8.1.0"]},{"vendor":"oracle","product":"financial_services_balance_sheet_planning","ranges":["8.0.8"]},{"vendor":"oracle","product":"financial_services_basel_regulatory_capital_basic","ranges":["8.1.0","≥ 8.0.6 and ≤ 8.0.8"]},{"vendor":"oracle","product":"financial_services_basel_regulatory_capital_internal_ratings_based_approach","ranges":["8.1.0","≥ 8.0.6 and ≤ 8.0.8"]},{"vendor":"oracle","product":"financial_services_data_foundation","ranges":["≥ 8.0.6 and ≤ 8.1.0"]},{"vendor":"oracle","product":"financial_services_data_governance_for_us_regulatory_reporting","ranges":["≥ 8.0.6 and ≤ 8.0.9"]},{"vendor":"oracle","product":"financial_services_data_integration_hub","ranges":["8.0.7","8.0.6","8.1.0"]},{"vendor":"oracle","product":"financial_services_funds_transfer_pricing","ranges":["8.1.0","8.0.6","8.0.7"]},{"vendor":"oracle","product":"financial_services_hedge_management_and_ifrs_valuations","ranges":["≥ 8.0.6 and ≤ 8.0.8","8.1.0"]},{"vendor":"oracle","product":"financial_services_institutional_performance_analytics","ranges":["8.0.7","8.0.6","8.1.0"]},{"vendor":"oracle","product":"financial_services_liquidity_risk_management","ranges":["8.0.6"]},{"vendor":"oracle","product":"financial_services_liquidity_risk_measurement_and_management","ranges":["8.1.0","8.0.8","8.0.7"]},{"vendor":"oracle","product":"financial_services_loan_loss_forecasting_and_provisioning","ranges":["≥ 8.0.6 and ≤ 8.0.8","8.1.0"]},{"vendor":"oracle","product":"financial_services_market_risk_measurement_and_management","ranges":["8.0.8","8.0.6"]},{"vendor":"oracle","product":"financial_services_price_creation_and_discovery","ranges":["8.0.7","8.0.6"]},{"vendor":"oracle","product":"financial_services_profitability_management","ranges":["8.0.6","8.1.0","8.0.7"]},{"vendor":"oracle","product":"financial_services_regulatory_reporting_for_european_banking_authority","ranges":["≥ 8.0.6 and ≤ 8.1.0"]},{"vendor":"oracle","product":"financial_services_regulatory_reporting_for_us_federal_reserve","ranges":["≥ 8.0.6 and ≤ 8.0.9"]},{"vendor":"oracle","product":"healthcare_foundation","ranges":["7.2.1","7.3.0","7.1.1","7.2.0"]},{"vendor":"oracle","product":"hospitality_materials_control","ranges":["18.1"]},{"vendor":"oracle","product":"hospitality_simphony","ranges":["18.1","19.1.0-19.1.2","18.2","≥ 19.1.0 and ≤ 19.1.2"]},{"vendor":"oracle","product":"insurance_accounting_analyzer","ranges":["8.0.9"]},{"vendor":"oracle","product":"insurance_allocation_manager_for_enterprise_profitability","ranges":["8.1.0","8.0.8"]},{"vendor":"oracle","product":"insurance_data_foundation","ranges":["≥ 8.0.6 and ≤ 8.1.0","8.0.6-8.1.0"]},{"vendor":"oracle","product":"insurance_insbridge_rating_and_underwriting","ranges":["≥ 5.0.0.0 and ≤ 5.6.0.0","5.6.1.0"]},{"vendor":"oracle","product":"jdeveloper","ranges":["12.2.1.3.0","12.2.1.4.0","11.1.1.9.0"]},{"vendor":"oracle","product":"peoplesoft_enterprise_peopletools","ranges":["8.56","8.57","8.58"]},{"vendor":"oracle","product":"policy_automation","ranges":["≥ 12.2.0 and ≤ 12.2.20"]},{"vendor":"oracle","product":"policy_automation_connector_for_siebel","ranges":["10.4.6"]},{"vendor":"oracle","product":"policy_automation_for_mobile_devices","ranges":["≥ 12.2.0 and ≤ 12.2.20"]},{"vendor":"oracle","product":"retail_back_office","ranges":["14.1","14.0"]},{"vendor":"oracle","product":"retail_customer_management_and_segmentation_foundation","ranges":["19.0"]},{"vendor":"oracle","product":"retail_returns_management","ranges":["14.0","14.1"]},{"vendor":"oracle","product":"siebel_ui_framework","ranges":["20.8"]},{"vendor":"oracle","product":"storagetek_acsls","ranges":["8.5.1"]},{"vendor":"oracle","product":"weblogic_server","ranges":["12.1.3.0.0","12.2.1.4.0","14.1.1.0.0","10.3.6.0.0","12.2.1.3.0"]},{"vendor":"tenable","product":"log_correlation_engine","ranges":["< 6.0.9"]}]}