Attacker Value
Unknown
CVE-2020-11022
CVE-2020-11022
(Last updated November 08, 2023) ▾
MITRE ATT&CK
Log in to add MITRE ATT&CK tag
Add MITRE ATT&CK tactics and techniques that apply to this CVE.
Description
In jQuery versions greater than or equal to 1.2 and before 3.5.0, passing HTML from untrusted sources – even after sanitizing it – to one of jQuery’s DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.
Add Assessment
No one has assessed this topic. Be the first to add your voice to the community.
CVSS V3 Severity and Metrics
Data provided by the National Vulnerability Database (NVD)
Base Score:
6.1 Medium
Impact Score:
2.7
Exploitability Score:
2.8
Attack Vector (AV):
Network
Attack Complexity (AC):
Low
Privileges Required (PR):
None
User Interaction (UI):
Required
Scope (S):
Changed
Confidentiality (C):
Low
Integrity (I):
Low
Availability (A):
None
General Information
Vendors
- debian,
- drupal,
- fedoraproject,
- jquery,
- netapp,
- opensuse,
- oracle,
- tenable
Products
- agile product lifecycle management for process 6.2.0.0,
- agile product supplier collaboration for process 6.2.0.0,
- application testing suite 13.3.0.1,
- banking digital experience,
- banking digital experience 18.1,
- banking digital experience 18.2,
- banking digital experience 18.3,
- banking digital experience 19.1,
- banking digital experience 19.2,
- banking digital experience 20.1,
- blockchain platform,
- communications application session controller 3.8m0,
- communications billing and revenue management 12.0.0.3.0,
- communications billing and revenue management 7.5.0.23.0,
- communications diameter signaling router idih:,
- communications eagle application processor,
- communications services gatekeeper 7.0,
- communications webrtc session controller 7.2,
- debian linux 9.0,
- drupal,
- enterprise manager ops center 12.4.0.0,
- enterprise session border controller 8.4,
- fedora 31,
- fedora 32,
- fedora 33,
- financial services analytical applications infrastructure,
- financial services analytical applications reconciliation framework,
- financial services analytical applications reconciliation framework 8.1.0,
- financial services asset liability management 8.0.6,
- financial services asset liability management 8.0.7,
- financial services asset liability management 8.1.0,
- financial services balance sheet planning 8.0.8,
- financial services basel regulatory capital basic,
- financial services basel regulatory capital basic 8.1.0,
- financial services basel regulatory capital internal ratings based approach,
- financial services basel regulatory capital internal ratings based approach 8.1.0,
- financial services data foundation,
- financial services data governance for us regulatory reporting,
- financial services data integration hub 8.0.6,
- financial services data integration hub 8.0.7,
- financial services data integration hub 8.1.0,
- financial services funds transfer pricing 8.0.6,
- financial services funds transfer pricing 8.0.7,
- financial services funds transfer pricing 8.1.0,
- financial services hedge management and ifrs valuations,
- financial services hedge management and ifrs valuations 8.1.0,
- financial services institutional performance analytics 8.0.6,
- financial services institutional performance analytics 8.0.7,
- financial services institutional performance analytics 8.1.0,
- financial services liquidity risk management 8.0.6,
- financial services liquidity risk measurement and management 8.0.7,
- financial services liquidity risk measurement and management 8.0.8,
- financial services liquidity risk measurement and management 8.1.0,
- financial services loan loss forecasting and provisioning,
- financial services loan loss forecasting and provisioning 8.1.0,
- financial services market risk measurement and management 8.0.6,
- financial services market risk measurement and management 8.0.8,
- financial services price creation and discovery 8.0.6,
- financial services price creation and discovery 8.0.7,
- financial services profitability management 8.0.6,
- financial services profitability management 8.0.7,
- financial services profitability management 8.1.0,
- financial services regulatory reporting for european banking authority,
- financial services regulatory reporting for us federal reserve,
- h300e firmware -,
- h300s firmware -,
- h410c firmware -,
- h410s firmware -,
- h500e firmware -,
- h500s firmware -,
- h700e firmware -,
- h700s firmware -,
- healthcare foundation 7.1.1,
- healthcare foundation 7.2.0,
- healthcare foundation 7.2.1,
- healthcare foundation 7.3.0,
- hospitality materials control 18.1,
- hospitality simphony,
- hospitality simphony 18.1,
- hospitality simphony 18.2,
- hospitality simphony 19.1.0-19.1.2,
- insurance accounting analyzer 8.0.9,
- insurance allocation manager for enterprise profitability 8.0.8,
- insurance allocation manager for enterprise profitability 8.1.0,
- insurance data foundation,
- insurance data foundation 8.0.6-8.1.0,
- insurance insbridge rating and underwriting,
- insurance insbridge rating and underwriting 5.6.1.0,
- jdeveloper 11.1.1.9.0,
- jdeveloper 12.2.1.3.0,
- jdeveloper 12.2.1.4.0,
- jquery,
- leap 15.1,
- leap 15.2,
- log correlation engine,
- max data -,
- oncommand insight -,
- oncommand system manager,
- peoplesoft enterprise peopletools 8.56,
- peoplesoft enterprise peopletools 8.57,
- peoplesoft enterprise peopletools 8.58,
- policy automation,
- policy automation connector for siebel 10.4.6,
- policy automation for mobile devices,
- retail back office 14.0,
- retail back office 14.1,
- retail customer management and segmentation foundation 19.0,
- retail returns management 14.0,
- retail returns management 14.1,
- siebel ui framework 20.8,
- snap creator framework -,
- snapcenter -,
- storagetek acsls 8.5.1,
- weblogic server 10.3.6.0.0,
- weblogic server 12.1.3.0.0,
- weblogic server 12.2.1.3.0,
- weblogic server 12.2.1.4.0,
- weblogic server 14.1.1.0.0
Exploited in the Wild
References
Advisory
Miscellaneous
