WaratekVRT Sign in

CVE-2020-7656 jquery

Affected softwarejquery
Severity6.1 Medium CVSS 3.1 2 scores
WeaknessCross-site scripting (CWE-79)
Published19 May 2020
Updated13 Nov 2026

Description

jquery prior to 1.9.0 allows Cross-site Scripting attacks via the load method. The load method fails to recognize and remove "<script>" HTML tags that contain a whitespace character, i.e: "</script >", which results in the enclosed script logic to be executed.

Exploitation status

Working exploit published

A reviewed exploit catalogue lists ready-to-run exploit code for this CVE.
  • CISA KEV not listed
  • VulnCheck KEV not listed
  • CISA Vulnrichment no assessment published
  • Indexed PoC 1 indexed Published artifacts you can open, in Exploit-DB; first seen 2025-04-08.
  • EPSS 6.4% chance in 30 days
IndexArtifactStarsFirst seen
Exploit-DB jQuery 3.3.1 - Prototype Pollution & XSS Exploit 2025-04-08

Waratek protection

Protected by Waratek

Waratek has a rule that blocks attacks on this vulnerability.

  • Protection full XSS
  • Action available security rule
  • Review human Researcher
  • Record active
Decided by A researcher's recorded decision for this specific CVE
Finding A researcher found this CVE protected by the ARMR XSS rule.

Waratek research note

written 2026-11-13

Written by a Waratek engineer who reviewed this CVE. Their decision sets the status above, ahead of every automated rule except a withdrawal.

Comments

Rule Name: XSS rule

How to mitigate CVE-2020-7656

Apply the vendor's fix for jquery. Until you can, Waratek RASP blocks exploitation with its XSS rule. It runs inside the Java application, with no code changes.

Waratek RASP Runtime protection for Java applications

CVSS

6.1 MEDIUM v3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N 2 metrics

We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.

VersionScoreBandVectorAssignerType
CVSS 3.1 6.1 MEDIUM CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N NVD Primary published
CVSS 2.0 4.3 none AV:N/AC:M/Au:N/C:N/I:P/A:N NVD Primary

Affected software and releases

Oracle advisories

AdvisoryTypeQuarterProducts Oracle names in its risk matrix
Oracle Critical Patch Update July 2022 ↗ CPU 2022-Q3 Oracle PeopleSoft / PeopleSoft CDA (jQuery) (8.58)

Oracle components and versions

FamilyComponentVersions, as Oracle lists themRead as
Oracle PeopleSoft PeopleSoft CDA (jQuery) 8.58 8.58

Products and versions

7 products, 7 version entries
SourceVendorProductSchemeAffected versions
nvd jquery jquery generic ＜ 1.9.0
nvd juniper junos generic 21.2
nvd netapp active iq unified manager generic any version
nvd netapp cloud backup generic any version
nvd netapp oncommand system manager generic ≥ 3.0.0 and ≤ 3.1.3
nvd netapp snap creator framework generic any version
nvd oracle peoplesoft enterprise peopletools generic 8.58

References

URLTags
https://security.netapp.com/advisory/ntap-20200528-0001/ Third Party Advisory
https://snyk.io/vuln/SNYK-JS-JQUERY-569619 Exploit, Third Party Advisory
https://supportportal.juniper.net/s/article/2021-07-Security-Bulletin-Junos-OS-Multiple-J-Web-vulnerabilities-resolved-in-Junos-OS-21-2R1?language=en_US Third Party Advisory
https://www.oracle.com/security-alerts/cpujul2022.html Third Party Advisory

Timeline
Published2020-05-19By the CVE Program.
NVD record modified2026-06-17NVD's own last-modified date for this record.
Classification created2026-11-13First commit adding this CVE's research note.
Last VRT activity2026-11-13Most recent commit touching this CVE's classification, patch or rule file.