CVE-2020-7656

描述

Versions of `jquery` prior to 1.9.0 are vulnerable to Cross-Site Scripting. The load method fails to recognize and remove `<script>` HTML tags that contain a whitespace character, i.e: `</script >`, which results in the enclosed script logic to be executed. This allows attackers to execute arbitrary JavaScript in a victim's browser. ## Recommendation Upgrade to version 1.9.0 or later.

如何修補 CVE-2020-7656

要修補 CVE-2020-7656,請將受影響套件升級到下列已修補版本。

• —升級至 1.9.0 或更新版本
• —升級至 1.9.0 或更新版本
• —升級至 2.2.0 或更新版本
• —升級至 1.9.0 或更新版本

CVE-2020-7656 正在被利用嗎?

中等 — EPSS 為 6.3%,可持續追蹤但非最高優先。

受影響套件(4)

• >= 1.2.1, < 1.9.0
• >= 1.2.1, < 1.9.0
• from 0, < 2.2.0
• >= 1.2.1, < 1.9.0

CVSS 分數

參考連結(12)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2020-7656
• PATCHgithub.com/jquery/jquery
• WEBgithub.com/jquery/jquery/blob/9e6393b0bcb52b15313f88141d0bd7dd54227426/src/ajax.js#L203
• WEBgithub.com/jquery/jquery/commit/05531fc4080ae24070930d15ae0cea7ae056457d