CVE-2020-11023 jQuery
| Affected software | jQuery |
|---|---|
| Severity | 6.9 Medium CVSS 3.1 3 scores |
| Weakness | Cross-site scripting (CWE-79) |
| Published | 29 Apr 2020 |
| Updated | 17 Jun 2026 |
Description
In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.
Exploitation status
Exploited
Confirmed real-world exploitation.
Exploitation status
- CISA KEV listed Confirmed exploitation in the wild. Added 2025-01-23 · remediation due 2025-02-13 · ransomware use: unknown
- VulnCheck KEV listed Exploitation reported in the wild. 6 citations · 1 exploit · earliest 2021-01-21.
- CISA Vulnrichment exploitation: active CISA records active exploitation. Automatable: no, technical impact: partial.
- Indexed PoC 6 indexed Published artifacts you can open, in Exploit-DB, GitHub PoC; first seen 2021-04-14.
- EPSS 85% chance in 30 days A model's forecast, not a report of exploitation. Higher than 99.7% of all scored CVEs.
VulnCheck KEV
Exploitation evidence from VulnCheck Known Exploited Vulnerabilities (VulnCheck KEV), used under VulnCheck's community terms. View CVE-2020-11023 in VulnCheck (free account), which lists 1 more citation not shown here.
| Evidence | Source | Detail | Date |
|---|---|---|---|
| Reported exploitation | tenable.com | /blog/daisy-chaining-how-vulnerabilities-can-be-greater-than-the-sum-of-their-parts | 2021-01-21 |
| Reported exploitation | securin.io | /wp-content/uploads/2023/08/2023-State-of-Cybersecurity-for-Medical-Devices-and-Healthcare-Systems.pdf | 2023-08-08 |
| Reported exploitation | cisa.gov | /sites/default/files/feeds/known_exploited_vulnerabilities.json | 2025-01-23 |
| Reported exploitation | trustwave.com | /hubfs/Web/Library/Documents_pdf/Risk_Radar_Tech_2025.pdf | 2025-06-25 |
| Reported exploitation | loginsoft.com | /reports/annually/vulnerability-intelligence-report-2025 | 2026-01-20 |
| Exploit reference | VulnCheck XDB cd24aa175d62 | Exploit type: client-side | 2021-10-16 |
| Index | Artifact | Stars | First seen |
|---|---|---|---|
| GitHub PoC | CVE-2020-11023 PoC for bug bounty. | 5 | 2024-01-03 |
| GitHub PoC | honeyb33z/cve-2020-11023-scanner | 4 | 2025-01-30 |
| GitHub PoC | Offline jQuery CVE-2020-11023 remediation kit for legacy Spring/JSP - Node.js built-ins only (no npm, no internet) | 1 | 2026-07-05 |
| GitHub PoC | Vulnearability Report of the New Jersey official site | 1 | 2022-05-23 |
| GitHub PoC | Demonstration of CVE-2020-11023 | 2024-04-13 | |
| Exploit-DB | jQuery 1.0.3 - Cross-Site Scripting (XSS) | 2021-04-14 |
Waratek protection
A Java vulnerability, but not one Waratek protects. It affects only Java on a user's desktop (applets, Web Start, JavaFX, the installer), sits in a product the Waratek agent can't be installed into, or is in a package we don't expect in business applications. The decision below says which.
- Protection none
- Action not pursued none
- Review human Researcher
- Record active
| Decided by | Manual classification of this CVE in the legacy dataset |
|---|---|
| Finding | A manual classification set this CVE's status to Outside Waratek scope, but the CVE names a tracked product. |
CVSS
6.9 MEDIUM
v3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N
3 metrics
CVSS
6.9 MEDIUM v3.1CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N
3 metrics
We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.
| Version | Score | Band | Vector | Assigner | Type | |
|---|---|---|---|---|---|---|
| CVSS 3.1 | 6.9 | MEDIUM | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N |
security-advisories@github.com | Secondary | published |
| CVSS 3.1 | 6.1 | MEDIUM | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
NVD | Primary | |
| CVSS 2.0 | 4.3 | none | AV:N/AC:M/Au:N/C:N/I:P/A:N |
NVD | Primary |
Affected software and releases
Oracle advisories
| Advisory | Type | Quarter | Products Oracle names in its risk matrix |
|---|---|---|---|
| Oracle Critical Patch Update October 2024 ↗ | CPU | 2024-Q4 | Oracle Fusion Middleware / Security Framework (jQuery) (12.2.1.4.0) |
| Oracle Critical Patch Update October 2023 ↗ | CPU | 2023-Q4 | Oracle Analytics / Mobile Service (jQuery) (12.2.1.4.0) |
| Oracle Critical Patch Update July 2022 ↗ | CPU | 2022-Q3 | Oracle Fusion Middleware / Service Administration UI (JQuery) (5.9.0.0.0) |
| Oracle Critical Patch Update January 2022 ↗ | CPU | 2022-Q1 | Oracle Fusion Middleware / Sample apps (jQuery) (12.2.1.4.0, 14.1.1.0.0) |
| Oracle Critical Patch Update October 2021 ↗ | CPU | 2021-Q4 | Oracle Health Sciences Applications / UI (jQuery) (6.3.0) |
| Oracle Critical Patch Update July 2021 ↗ | CPU | 2021-Q3 | Oracle Support Tools / Diagnostic Assistant (jQuery) (Prior to 2.12.41) |
| Oracle Critical Patch Update April 2021 ↗ | CPU | 2021-Q2 | Oracle Database Server / Oracle Application Express (jQuery) (Prior to 20.2) |
| Oracle Critical Patch Update October 2020 ↗ | CPU | 2020-Q4 | Oracle Database Server / ORDS (jQuery) (11.2.0.4, 12.1.0.2, 12.2.0.1, 18c, 19c) Oracle's note: Additional ORDS bugs are documented in the risk matrix "Oracle REST Data Services Risk Matrix" Oracle Database Server / Oracle Application Express (jQuery) (Prior to 20.2) Oracle REST Data Services / General (jQuery) (11.2.0.4, 12.1.0.2, 12.2.0.1, 18c, 19c; Standalone ORDS: prior to 20.2.1) |
Oracle components and versions
| Family | Component | Versions, as Oracle lists them | Read as |
|---|---|---|---|
| Oracle Analytics | Mobile Service (jQuery) | 12.2.1.4.0 | 12.2.1.4.0 |
| Oracle Database Server | ORDS (jQuery) | 11.2.0.4, 12.1.0.2, 12.2.0.1, 18c, 19c | 11.2.0.4 · 12.1.0.2 · 12.2.0.1 · 18 · 19 |
| Oracle Database Server | Oracle Application Express (jQuery) | Prior to 20.2 | |
| Oracle Fusion Middleware | Sample apps (jQuery) | 12.2.1.4.0, 14.1.1.0.0 | 12.2.1.4.0 · 14.1.1.0.0 |
| Oracle Fusion Middleware | Security Framework (jQuery) | 12.2.1.4.0 | 12.2.1.4.0 |
| Oracle Fusion Middleware | Service Administration UI (JQuery) | 5.9.0.0.0 | 5.9.0.0.0 |
| Oracle Health Sciences Applications | UI (jQuery) | 6.3.0 | 6.3.0 |
| Oracle REST Data Services | General (jQuery) | 11.2.0.4, 12.1.0.2, 12.2.0.1, 18c, 19c; Standalone ORDS: prior to 20.2.1 | 11.2.0.4 · 12.1.0.2 · 12.2.0.1 · 18 · 19 |
| Oracle Support Tools | Diagnostic Assistant (jQuery) | Prior to 2.12.41 |
Products and versions
52 products, 79 version entries| Source | Vendor | Product | Scheme | Affected versions |
|---|---|---|---|---|
| nvd | debian | debian linux | generic | 9.0 |
| nvd | drupal | drupal | generic | ≥ 7.0 and ＜ 7.70 · ≥ 8.7.0 and ＜ 8.7.14 · ≥ 8.8.0 and ＜ 8.8.6 |
| nvd | fedoraproject | fedora | generic | 31 · 32 · 33 |
| nvd | jquery | jquery | generic | ≥ 1.0.3 and ＜ 3.5.0 |
| nvd | netapp | active iq unified manager | generic | any version |
| nvd | netapp | cloud backup | generic | any version |
| nvd | netapp | cloud insights storage workload security agent | generic | any version |
| nvd | netapp | h300e firmware | generic | any version |
| nvd | netapp | h300s firmware | generic | any version |
| nvd | netapp | h410c firmware | generic | any version |
| nvd | netapp | h410s firmware | generic | any version |
| nvd | netapp | h500e firmware | generic | any version |
| nvd | netapp | h500s firmware | generic | any version |
| nvd | netapp | h700e firmware | generic | any version |
| nvd | netapp | h700s firmware | generic | any version |
| nvd | netapp | hci baseboard management controller | generic | any version |
| nvd | netapp | max data | generic | any version |
| nvd | netapp | oncommand insight | generic | any version |
| nvd | netapp | oncommand system manager | generic | ≥ 3.0 and ≤ 3.1.3 |
| nvd | netapp | snap creator framework | generic | any version |
| nvd | netapp | snapcenter server | generic | any version |
| nvd | oracle | application express | generic | ＜ 20.2 |
| nvd | oracle | application testing suite | generic | 13.3.0.1 |
| nvd | oracle | banking enterprise collections | generic | ≥ 2.7.0 and ≤ 2.8.0 |
| nvd | oracle | banking platform | generic | ≥ 2.4.0 and ≤ 2.10.0 |
| nvd | oracle | blockchain platform | generic | 21.1.2 · ＜ 21.1.2 |
| nvd | oracle | business intelligence | generic | 5.9.0.0.0 |
| nvd | oracle | communications analytics | generic | 12.1.1 |
| nvd | oracle | communications eagle application processor | generic | ≥ 16.1.0 and ≤ 16.4.0 |
| nvd | oracle | communications element manager | generic | 8.1.1 · 8.2.0 · 8.2.1 |
| nvd | oracle | communications interactive session recorder | generic | ≥ 6.1 and ≤ 6.4 |
| nvd | oracle | communications operations monitor | generic | 3.4 · ≥ 4.1 and ≤ 4.3 |
| nvd | oracle | communications services gatekeeper | generic | 7.0 |
| nvd | oracle | communications session report manager | generic | 8.1.1 · 8.2.0 · 8.2.1 |
| nvd | oracle | communications session route manager | generic | 8.1.1 · 8.2.0 · 8.2.1 |
| nvd | oracle | financial services regulatory reporting for de nederlandsche bank | generic | 8.0.4 |
| nvd | oracle | financial services revenue management and billing analytics | generic | 2.7 · 2.8 |
| nvd | oracle | health sciences inform | generic | 6.3.0 |
| nvd | oracle | healthcare translational research | generic | 3.2.1 · 3.3.1 · 3.3.2 · 3.4.0 |
| nvd | oracle | hyperion financial reporting | generic | 11.1.2.4 |
| nvd | oracle | jd edwards enterpriseone orchestrator | generic | ＜ 9.2.5.0 |
| nvd | oracle | jd edwards enterpriseone tools | generic | ＜ 9.2.5.0 |
| nvd | oracle | oss support tools | generic | ＜ 2.12.41 |
| nvd | oracle | peoplesoft enterprise human capital management resources | generic | 9.2 |
| nvd | oracle | primavera gateway | generic | ≥ 16.2 and ≤ 16.2.11 · ≥ 17.12.0 and ≤ 17.12.7 · ≥ 18.8.0 and ≤ 18.8.9 · ≥ 19.12.0 and ≤ 19.12.4 |
| nvd | oracle | rest data services | generic | 11.2.0.4 · 12.1.0.2 · 12.2.0.1 · 18c · 19c |
| nvd | oracle | siebel mobile | generic | ≤ 20.12 |
| nvd | oracle | storagetek acsls | generic | 8.5.1 |
| nvd | oracle | storagetek tape analytics sw tool | generic | 2.3.1 |
| nvd | oracle | webcenter sites | generic | 12.2.1.3.0 · 12.2.1.4.0 |
| nvd | oracle | weblogic server | generic | 12.1.3.0.0 · 12.2.1.3.0 · 12.2.1.4.0 · 14.1.1.0.0 |
| nvd | tenable | log correlation engine | generic | ＜ 6.0.9 |
Earlier manual review
A reviewer classified this CVE in an older dataset. We kept the labels and products below, but not the reviewer's reasoning.
## Manual Classification Context **Labels:** HTTP, SEE NOTE 1, NO AUTH REMOTE EXPLOIT, DIAGNOSTIC ASSISTANT (JQUERY), GENERAL (JQUERY), UI (JQUERY), SAMPLE APPS (JQUERY) **Products:** ORACLE SUPPORT TOOLS, OSS SUPPORT TOOLS, ORACLE DATABASE SERVER, JQUERY, ORACLE APPLICATION EXPRESS (JQUERY), ORDS (JQUERY), ORACLE REST DATA SERVICES, ORACLE HEALTH SCIENCES INFORM, ORACLE HEALTH SCIENCES APPLICATIONS, ORACLE WEBLOGIC SERVER, ORACLE FUSION MIDDLEWARE
References
Timeline
Timeline
| Published | 2020-04-29 | By the CVE Program. |
|---|---|---|
| VulnCheck KEV: earliest evidence | 2021-01-21 | Date of the oldest evidence of exploitation in VulnCheck KEV's record. VulnCheck does not publish the date it listed the CVE. |
| Added to CISA KEV | 2025-01-23 | Listed in CISA's Known Exploited Vulnerabilities catalog. |
| VulnCheck KEV: latest evidence | 2026-04-10 | Date of the newest report, exploit reference or honeypot sighting in VulnCheck KEV's record. |
| NVD record modified | 2026-06-17 | NVD's own last-modified date for this record. |