CVE-2020-11022

MEDIUM6.9EPSS 2.5%

Potential XSS vulnerability in jQuery

發布日:2020/4/29修改日:2026/4/28

描述

In jQuery starting with 1.12.0 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.

受影響套件(12)

Bitnami/drupal>= 7.0.0, < 7.70.0, >= 8.7.0, < 8.7.14, >= 8.8.0, < 8.8.6
Debian/drupal7from 0, < 7.52-2+deb9u10
Debian/jqueryfrom 0, < 3.1.1-2+deb9u2
Debian/node-jqueryfrom 0, < 3.5.0+dfsg-2
Debian/otrs2from 0, < 6.0.30-1
Maven/org.webjars.npm:jquery>= 1.12.0, < 3.5.0
npm/jquery>= 1.12.0, < 3.5.0
NuGet/jquery>= 1.12.0, < 3.5.0
Packagist/athlon1600/youtube-downloaderfrom 0, <= 4.0.0
Packagist/components/jquery>= 1.12.0, < 3.5.0
Packagist/maximebf/debugbarfrom 0, < 1.19.0
RubyGems/jquery-railsfrom 0, < 4.4.0

CVSS 分數

來源	版本	嚴重程度	向量
osv	CVSS 3.1	MEDIUM6.9	CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N

描述

受影響套件(12)

CVSS 分數

參考連結(74)