Attacker Value
Unknown
4
CVE-2020-11022
4
CVE ID
AttackerKB requires a CVE ID in order to pull vulnerability data and references from the CVE list and the National Vulnerability Database. If available, please supply below:
Add References:
CVE-2020-11022
(Last updated November 08, 2023) ▾
MITRE ATT&CK
Log in to add MITRE ATT&CK tag
Add MITRE ATT&CK tactics and techniques that apply to this CVE.
MITRE ATT&CK
Select the MITRE ATT&CK Tactics that apply to this CVE
Collection
Select any Techniques used:
Command and Control
Select any Techniques used:
Credential Access
Select any Techniques used:
Defense Evasion
Select any Techniques used:
Discovery
Select any Techniques used:
Execution
Select any Techniques used:
Exfiltration
Select any Techniques used:
Impact
Select any Techniques used:
Initial Access
Select any Techniques used:
Lateral Movement
Select any Techniques used:
Persistence
Select any Techniques used:
Privilege Escalation
Select any Techniques used:
Topic Tags
Select the tags that apply to this CVE (Assessment added tags are disabled and cannot be removed)
What makes this of high-value to an attacker?
What makes this of low-value to an attacker?
Description
In jQuery versions greater than or equal to 1.2 and before 3.5.0, passing HTML from untrusted sources – even after sanitizing it – to one of jQuery’s DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.
Add Assessment
No one has assessed this topic. Be the first to add your voice to the community.
CVSS V3 Severity and Metrics
Data provided by the National Vulnerability Database (NVD)
Base Score:
6.1 Medium
Impact Score:
2.7
Exploitability Score:
2.8
Attack Vector (AV):
Network
Attack Complexity (AC):
Low
Privileges Required (PR):
None
User Interaction (UI):
Required
Scope (S):
Changed
Confidentiality (C):
Low
Integrity (I):
Low
Availability (A):
None
General Information
Offensive Application
Unknown
Utility Class
Unknown
Ports
Unknown
OS
Unknown
Vulnerable Versions
jQuery >= 1.2, < 3.5.0
Prerequisites
Unknown
Discovered By
Unknown
PoC Author
Unknown
Metasploit Module
Unknown
Reporter
Unknown
Vendors
- debian,
- drupal,
- fedoraproject,
- jquery,
- netapp,
- opensuse,
- oracle,
- tenable
Products
- agile product lifecycle management for process 6.2.0.0,
- agile product supplier collaboration for process 6.2.0.0,
- application testing suite 13.3.0.1,
- banking digital experience,
- banking digital experience 18.1,
- banking digital experience 18.2,
- banking digital experience 18.3,
- banking digital experience 19.1,
- banking digital experience 19.2,
- banking digital experience 20.1,
- blockchain platform,
- communications application session controller 3.8m0,
- communications billing and revenue management 12.0.0.3.0,
- communications billing and revenue management 7.5.0.23.0,
- communications diameter signaling router idih:,
- communications eagle application processor,
- communications services gatekeeper 7.0,
- communications webrtc session controller 7.2,
- debian linux 9.0,
- drupal,
- enterprise manager ops center 12.4.0.0,
- enterprise session border controller 8.4,
- fedora 31,
- fedora 32,
- fedora 33,
- financial services analytical applications infrastructure,
- financial services analytical applications reconciliation framework,
- financial services analytical applications reconciliation framework 8.1.0,
- financial services asset liability management 8.0.6,
- financial services asset liability management 8.0.7,
- financial services asset liability management 8.1.0,
- financial services balance sheet planning 8.0.8,
- financial services basel regulatory capital basic,
- financial services basel regulatory capital basic 8.1.0,
- financial services basel regulatory capital internal ratings based approach,
- financial services basel regulatory capital internal ratings based approach 8.1.0,
- financial services data foundation,
- financial services data governance for us regulatory reporting,
- financial services data integration hub 8.0.6,
- financial services data integration hub 8.0.7,
- financial services data integration hub 8.1.0,
- financial services funds transfer pricing 8.0.6,
- financial services funds transfer pricing 8.0.7,
- financial services funds transfer pricing 8.1.0,
- financial services hedge management and ifrs valuations,
- financial services hedge management and ifrs valuations 8.1.0,
- financial services institutional performance analytics 8.0.6,
- financial services institutional performance analytics 8.0.7,
- financial services institutional performance analytics 8.1.0,
- financial services liquidity risk management 8.0.6,
- financial services liquidity risk measurement and management 8.0.7,
- financial services liquidity risk measurement and management 8.0.8,
- financial services liquidity risk measurement and management 8.1.0,
- financial services loan loss forecasting and provisioning,
- financial services loan loss forecasting and provisioning 8.1.0,
- financial services market risk measurement and management 8.0.6,
- financial services market risk measurement and management 8.0.8,
- financial services price creation and discovery 8.0.6,
- financial services price creation and discovery 8.0.7,
- financial services profitability management 8.0.6,
- financial services profitability management 8.0.7,
- financial services profitability management 8.1.0,
- financial services regulatory reporting for european banking authority,
- financial services regulatory reporting for us federal reserve,
- h300e firmware -,
- h300s firmware -,
- h410c firmware -,
- h410s firmware -,
- h500e firmware -,
- h500s firmware -,
- h700e firmware -,
- h700s firmware -,
- healthcare foundation 7.1.1,
- healthcare foundation 7.2.0,
- healthcare foundation 7.2.1,
- healthcare foundation 7.3.0,
- hospitality materials control 18.1,
- hospitality simphony,
- hospitality simphony 18.1,
- hospitality simphony 18.2,
- hospitality simphony 19.1.0-19.1.2,
- insurance accounting analyzer 8.0.9,
- insurance allocation manager for enterprise profitability 8.0.8,
- insurance allocation manager for enterprise profitability 8.1.0,
- insurance data foundation,
- insurance data foundation 8.0.6-8.1.0,
- insurance insbridge rating and underwriting,
- insurance insbridge rating and underwriting 5.6.1.0,
- jdeveloper 11.1.1.9.0,
- jdeveloper 12.2.1.3.0,
- jdeveloper 12.2.1.4.0,
- jquery,
- leap 15.1,
- leap 15.2,
- log correlation engine,
- max data -,
- oncommand insight -,
- oncommand system manager,
- peoplesoft enterprise peopletools 8.56,
- peoplesoft enterprise peopletools 8.57,
- peoplesoft enterprise peopletools 8.58,
- policy automation,
- policy automation connector for siebel 10.4.6,
- policy automation for mobile devices,
- retail back office 14.0,
- retail back office 14.1,
- retail customer management and segmentation foundation 19.0,
- retail returns management 14.0,
- retail returns management 14.1,
- siebel ui framework 20.8,
- snap creator framework -,
- snapcenter -,
- storagetek acsls 8.5.1,
- weblogic server 10.3.6.0.0,
- weblogic server 12.1.3.0.0,
- weblogic server 12.2.1.3.0,
- weblogic server 12.2.1.4.0,
- weblogic server 14.1.1.0.0
Exploited in the Wild
gwillcox-r7
indicated source as
News Article or Blog (https://cybersecurityworks.com/patchwatch/july-oracle-patches-342-security-vulnerabilities.html)
Would you like to delete this Exploited in the Wild Report?
Yes, delete this reportWould you like to delete this Exploited in the Wild Report?
Yes, delete this reportReferences
Advisory
Miscellaneous
Additional Info
Authenticated
Unknown
Exploitable
Unknown
Reliability
Unknown
Stability
Unknown
Available Mitigations
Unknown
Shelf Life
Unknown
Userbase/Installbase
Unknown
Patch Effectiveness
Unknown
Rapid7
Technical Analysis
Report as Emergent Threat Response
Report as Exploited in the Wild
CVE ID
AttackerKB requires a CVE ID in order to pull vulnerability data and references from the CVE list and the National Vulnerability Database. If available, please supply below: