{"cve_id":"CVE-2020-11023","published":"2020-04-29T21:15:11.743000+00:00","last_modified":"2026-06-17T02:48:52.930000+00:00","vuln_status":"Analyzed","description":"In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.","cvss_version":"3.1","cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","base_score":6.1,"base_severity":"MEDIUM","attack_vector":"NETWORK","privileges_req":"NONE","user_interaction":"REQUIRED","scope":"CHANGED","impact_c":"LOW","impact_i":"LOW","impact_a":"NONE","cwe_ids":["CWE-79"],"in_kev":true,"kev_date_added":"2025-01-23","kev_ransomware":false,"epss_score":0.84887,"epss_percentile":0.99711,"cap_rule_version":"0.1.1","stage":"CRED_ACCESS","req_access":"NONE","req_vector":"NETWORK","req_user_interaction":true,"grant_access":"NONE","caps":["CRED_ACCESS","INFO_DISCLOSURE","TAMPER"],"terminal":false,"cap_confidence":"high","ingested_at":"2026-09-18T09:17:16.024437+00:00","first_seen":"2020-04-29T21:15:11.743000+00:00","kev_first_seen":"2025-01-23T00:00:00+00:00","novelty_score":0.0,"novelty_reasons":[],"novelty_at":null,"vendors":["debian","drupal","fedoraproject","jquery","netapp","oracle","tenable"],"products":["active_iq_unified_manager","application_express","application_testing_suite","banking_enterprise_collections","banking_platform","blockchain_platform","business_intelligence","cloud_backup","cloud_insights_storage_workload_security_agent","communications_analytics","communications_eagle_application_processor","communications_element_manager","communications_interactive_session_recorder","communications_operations_monitor","communications_services_gatekeeper","communications_session_report_manager","communications_session_route_manager","debian_linux","drupal","fedora","financial_services_regulatory_reporting_for_de_nederlandsche_bank","financial_services_revenue_management_and_billing_analytics","h300e","h300e_firmware","h300s","h300s_firmware","h410c","h410c_firmware","h410s","h410s_firmware","h500e","h500e_firmware","h500s","h500s_firmware","h700e","h700e_firmware","h700s","h700s_firmware","hci_baseboard_management_controller","health_sciences_inform","healthcare_translational_research","hyperion_financial_reporting","jd_edwards_enterpriseone_orchestrator","jd_edwards_enterpriseone_tools","jquery","log_correlation_engine","max_data","oncommand_insight","oncommand_system_manager","oss_support_tools","peoplesoft_enterprise_human_capital_management_resources","primavera_gateway","rest_data_services","siebel_mobile","snap_creator_framework","snapcenter_server","storagetek_acsls","storagetek_tape_analytics_sw_tool","webcenter_sites","weblogic_server"],"affected":[{"vendor":"debian","product":"debian_linux","ranges":["9.0"]},{"vendor":"drupal","product":"drupal","ranges":["≥ 7.0 and < 7.70","≥ 8.7.0 and < 8.7.14","≥ 8.8.0 and < 8.8.6"]},{"vendor":"fedoraproject","product":"fedora","ranges":["32","31","33"]},{"vendor":"jquery","product":"jquery","ranges":["≥ 1.0.3 and < 3.5.0"]},{"vendor":"netapp","product":"active_iq_unified_manager","ranges":["all versions"]},{"vendor":"netapp","product":"cloud_backup","ranges":["all versions"]},{"vendor":"netapp","product":"cloud_insights_storage_workload_security_agent","ranges":["all versions"]},{"vendor":"netapp","product":"h300e_firmware","ranges":["all versions"]},{"vendor":"netapp","product":"h300s_firmware","ranges":["all versions"]},{"vendor":"netapp","product":"h410c_firmware","ranges":["all versions"]},{"vendor":"netapp","product":"h410s_firmware","ranges":["all versions"]},{"vendor":"netapp","product":"h500e_firmware","ranges":["all versions"]},{"vendor":"netapp","product":"h500s_firmware","ranges":["all versions"]},{"vendor":"netapp","product":"h700e_firmware","ranges":["all versions"]},{"vendor":"netapp","product":"h700s_firmware","ranges":["all versions"]},{"vendor":"netapp","product":"hci_baseboard_management_controller","ranges":["all versions"]},{"vendor":"netapp","product":"max_data","ranges":["all versions"]},{"vendor":"netapp","product":"oncommand_insight","ranges":["all versions"]},{"vendor":"netapp","product":"oncommand_system_manager","ranges":["≥ 3.0 and ≤ 3.1.3"]},{"vendor":"netapp","product":"snap_creator_framework","ranges":["all versions"]},{"vendor":"netapp","product":"snapcenter_server","ranges":["all versions"]},{"vendor":"oracle","product":"application_express","ranges":["< 20.2"]},{"vendor":"oracle","product":"application_testing_suite","ranges":["13.3.0.1"]},{"vendor":"oracle","product":"banking_enterprise_collections","ranges":["≥ 2.7.0 and ≤ 2.8.0"]},{"vendor":"oracle","product":"banking_platform","ranges":["≥ 2.4.0 and ≤ 2.10.0"]},{"vendor":"oracle","product":"blockchain_platform","ranges":["< 21.1.2","21.1.2"]},{"vendor":"oracle","product":"business_intelligence","ranges":["5.9.0.0.0"]},{"vendor":"oracle","product":"communications_analytics","ranges":["12.1.1"]},{"vendor":"oracle","product":"communications_eagle_application_processor","ranges":["≥ 16.1.0 and ≤ 16.4.0"]},{"vendor":"oracle","product":"communications_element_manager","ranges":["8.2.0","8.2.1","8.1.1"]},{"vendor":"oracle","product":"communications_interactive_session_recorder","ranges":["≥ 6.1 and ≤ 6.4"]},{"vendor":"oracle","product":"communications_operations_monitor","ranges":["≥ 4.1 and ≤ 4.3","3.4"]},{"vendor":"oracle","product":"communications_services_gatekeeper","ranges":["7.0"]},{"vendor":"oracle","product":"communications_session_report_manager","ranges":["8.1.1","8.2.1","8.2.0"]},{"vendor":"oracle","product":"communications_session_route_manager","ranges":["8.2.0","8.2.1","8.1.1"]},{"vendor":"oracle","product":"financial_services_regulatory_reporting_for_de_nederlandsche_bank","ranges":["8.0.4"]},{"vendor":"oracle","product":"financial_services_revenue_management_and_billing_analytics","ranges":["2.7","2.8"]},{"vendor":"oracle","product":"health_sciences_inform","ranges":["6.3.0"]},{"vendor":"oracle","product":"healthcare_translational_research","ranges":["3.3.1","3.4.0","3.3.2","3.2.1"]},{"vendor":"oracle","product":"hyperion_financial_reporting","ranges":["11.1.2.4"]},{"vendor":"oracle","product":"jd_edwards_enterpriseone_orchestrator","ranges":["< 9.2.5.0"]},{"vendor":"oracle","product":"jd_edwards_enterpriseone_tools","ranges":["< 9.2.5.0"]},{"vendor":"oracle","product":"oss_support_tools","ranges":["< 2.12.41"]},{"vendor":"oracle","product":"peoplesoft_enterprise_human_capital_management_resources","ranges":["9.2"]},{"vendor":"oracle","product":"primavera_gateway","ranges":["≥ 16.2 and ≤ 16.2.11","≥ 19.12.0 and ≤ 19.12.4","≥ 18.8.0 and ≤ 18.8.9","≥ 17.12.0 and ≤ 17.12.7"]},{"vendor":"oracle","product":"rest_data_services","ranges":["19c","18c","12.2.0.1","12.1.0.2","11.2.0.4"]},{"vendor":"oracle","product":"siebel_mobile","ranges":["≤ 20.12"]},{"vendor":"oracle","product":"storagetek_acsls","ranges":["8.5.1"]},{"vendor":"oracle","product":"storagetek_tape_analytics_sw_tool","ranges":["2.3.1"]},{"vendor":"oracle","product":"webcenter_sites","ranges":["12.2.1.4.0","12.2.1.3.0"]},{"vendor":"oracle","product":"weblogic_server","ranges":["14.1.1.0.0","12.2.1.4.0","12.2.1.3.0","12.1.3.0.0"]},{"vendor":"tenable","product":"log_correlation_engine","ranges":["< 6.0.9"]}]}