CVE-2020-11023 (CNNVD-202004-2420)

MEDIUM 有利用代码
中文标题:
jQuery 跨站脚本漏洞
英文标题:
Potential XSS vulnerability in jQuery
CVSS分数: 6.9
发布时间: 2020-04-29 00:00:00
漏洞类型: 跨站脚本
状态: PUBLISHED
数据质量分数: 0.30
数据版本: v4
漏洞描述
中文描述:

jQuery是美国John Resig个人开发者的一套开源、跨浏览器的JavaScript库。该库简化了HTML与JavaScript之间的操作，并具有模块化、插件扩展等特点。 jQuery 1.0.3版本至3.5.0之前版本中存在跨站脚本漏洞。该漏洞源于WEB应用缺少对客户端数据的正确验证。攻击者可利用该漏洞执行客户端代码。

英文描述:

In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.

CWE类型:
CWE-79
标签:
webapps multiple Central InfoSec
受影响产品
厂商 产品 版本 版本范围 平台 CPE
jquery jQuery >= 1.0.3, < 3.5.0 - - cpe:2.3:a:jquery:jquery:>=_1.0.3,_<_3.5.0:*:*:*:*:*:*:*
jquery jquery * - - cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*
debian debian_linux 9.0 - - cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
fedoraproject fedora 31 - - cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*
fedoraproject fedora 32 - - cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*
fedoraproject fedora 33 - - cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*
drupal drupal * - - cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*
oracle application_express * - - cpe:2.3:a:oracle:application_express:*:*:*:*:*:*:*:*
oracle application_testing_suite 13.3.0.1 - - cpe:2.3:a:oracle:application_testing_suite:13.3.0.1:*:*:*:*:*:*:*
oracle banking_enterprise_collections * - - cpe:2.3:a:oracle:banking_enterprise_collections:*:*:*:*:*:*:*:*
oracle banking_platform * - - cpe:2.3:a:oracle:banking_platform:*:*:*:*:*:*:*:*
oracle blockchain_platform * - - cpe:2.3:a:oracle:blockchain_platform:*:*:*:*:*:*:*:*
oracle blockchain_platform 21.1.2 - - cpe:2.3:a:oracle:blockchain_platform:21.1.2:*:*:*:*:*:*:*
oracle business_intelligence 5.9.0.0.0 - - cpe:2.3:a:oracle:business_intelligence:5.9.0.0.0:*:*:*:enterprise:*:*:*
oracle communications_analytics 12.1.1 - - cpe:2.3:a:oracle:communications_analytics:12.1.1:*:*:*:*:*:*:*
oracle communications_eagle_application_processor * - - cpe:2.3:a:oracle:communications_eagle_application_processor:*:*:*:*:*:*:*:*
oracle communications_element_manager 8.1.1 - - cpe:2.3:a:oracle:communications_element_manager:8.1.1:*:*:*:*:*:*:*
oracle communications_element_manager 8.2.0 - - cpe:2.3:a:oracle:communications_element_manager:8.2.0:*:*:*:*:*:*:*
oracle communications_element_manager 8.2.1 - - cpe:2.3:a:oracle:communications_element_manager:8.2.1:*:*:*:*:*:*:*
oracle communications_interactive_session_recorder * - - cpe:2.3:a:oracle:communications_interactive_session_recorder:*:*:*:*:*:*:*:*
oracle communications_operations_monitor * - - cpe:2.3:a:oracle:communications_operations_monitor:*:*:*:*:*:*:*:*
oracle communications_operations_monitor 3.4 - - cpe:2.3:a:oracle:communications_operations_monitor:3.4:*:*:*:*:*:*:*
oracle communications_services_gatekeeper 7.0 - - cpe:2.3:a:oracle:communications_services_gatekeeper:7.0:*:*:*:*:*:*:*
oracle communications_session_report_manager 8.1.1 - - cpe:2.3:a:oracle:communications_session_report_manager:8.1.1:*:*:*:*:*:*:*
oracle communications_session_report_manager 8.2.0 - - cpe:2.3:a:oracle:communications_session_report_manager:8.2.0:*:*:*:*:*:*:*
oracle communications_session_report_manager 8.2.1 - - cpe:2.3:a:oracle:communications_session_report_manager:8.2.1:*:*:*:*:*:*:*
oracle communications_session_route_manager 8.1.1 - - cpe:2.3:a:oracle:communications_session_route_manager:8.1.1:*:*:*:*:*:*:*
oracle communications_session_route_manager 8.2.0 - - cpe:2.3:a:oracle:communications_session_route_manager:8.2.0:*:*:*:*:*:*:*
oracle communications_session_route_manager 8.2.1 - - cpe:2.3:a:oracle:communications_session_route_manager:8.2.1:*:*:*:*:*:*:*
oracle financial_services_regulatory_reporting_for_de_nederlandsche_bank 8.0.4 - - cpe:2.3:a:oracle:financial_services_regulatory_reporting_for_de_nederlandsche_bank:8.0.4:*:*:*:*:*:*:*
oracle financial_services_revenue_management_and_billing_analytics 2.7 - - cpe:2.3:a:oracle:financial_services_revenue_management_and_billing_analytics:2.7:*:*:*:*:*:*:*
oracle financial_services_revenue_management_and_billing_analytics 2.8 - - cpe:2.3:a:oracle:financial_services_revenue_management_and_billing_analytics:2.8:*:*:*:*:*:*:*
oracle health_sciences_inform 6.3.0 - - cpe:2.3:a:oracle:health_sciences_inform:6.3.0:*:*:*:*:*:*:*
oracle healthcare_translational_research 3.2.1 - - cpe:2.3:a:oracle:healthcare_translational_research:3.2.1:*:*:*:*:*:*:*
oracle healthcare_translational_research 3.3.1 - - cpe:2.3:a:oracle:healthcare_translational_research:3.3.1:*:*:*:*:*:*:*
oracle healthcare_translational_research 3.3.2 - - cpe:2.3:a:oracle:healthcare_translational_research:3.3.2:*:*:*:*:*:*:*
oracle healthcare_translational_research 3.4.0 - - cpe:2.3:a:oracle:healthcare_translational_research:3.4.0:*:*:*:*:*:*:*
oracle hyperion_financial_reporting 11.1.2.4 - - cpe:2.3:a:oracle:hyperion_financial_reporting:11.1.2.4:*:*:*:*:*:*:*
oracle jd_edwards_enterpriseone_orchestrator * - - cpe:2.3:a:oracle:jd_edwards_enterpriseone_orchestrator:*:*:*:*:*:*:*:*
oracle jd_edwards_enterpriseone_tools * - - cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:*:*:*:*:*:*:*:*
oracle oss_support_tools * - - cpe:2.3:a:oracle:oss_support_tools:*:*:*:*:*:*:*:*
oracle peoplesoft_enterprise_human_capital_management_resources 9.2 - - cpe:2.3:a:oracle:peoplesoft_enterprise_human_capital_management_resources:9.2:*:*:*:*:*:*:*
oracle primavera_gateway * - - cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:*
oracle rest_data_services 11.2.0.4 - - cpe:2.3:a:oracle:rest_data_services:11.2.0.4:*:*:*:-:*:*:*
oracle rest_data_services 12.1.0.2 - - cpe:2.3:a:oracle:rest_data_services:12.1.0.2:*:*:*:-:*:*:*
oracle rest_data_services 12.2.0.1 - - cpe:2.3:a:oracle:rest_data_services:12.2.0.1:*:*:*:-:*:*:*
oracle rest_data_services 18c - - cpe:2.3:a:oracle:rest_data_services:18c:*:*:*:-:*:*:*
oracle rest_data_services 19c - - cpe:2.3:a:oracle:rest_data_services:19c:*:*:*:-:*:*:*
oracle siebel_mobile * - - cpe:2.3:a:oracle:siebel_mobile:*:*:*:*:*:*:*:*
oracle storagetek_acsls 8.5.1 - - cpe:2.3:a:oracle:storagetek_acsls:8.5.1:*:*:*:*:*:*:*
oracle storagetek_tape_analytics_sw_tool 2.3.1 - - cpe:2.3:a:oracle:storagetek_tape_analytics_sw_tool:2.3.1:*:*:*:*:*:*:*
oracle webcenter_sites 12.2.1.3.0 - - cpe:2.3:a:oracle:webcenter_sites:12.2.1.3.0:*:*:*:*:*:*:*
oracle webcenter_sites 12.2.1.4.0 - - cpe:2.3:a:oracle:webcenter_sites:12.2.1.4.0:*:*:*:*:*:*:*
oracle weblogic_server 12.1.3.0.0 - - cpe:2.3:a:oracle:weblogic_server:12.1.3.0.0:*:*:*:*:*:*:*
oracle weblogic_server 12.2.1.3.0 - - cpe:2.3:a:oracle:weblogic_server:12.2.1.3.0:*:*:*:*:*:*:*
oracle weblogic_server 12.2.1.4.0 - - cpe:2.3:a:oracle:weblogic_server:12.2.1.4.0:*:*:*:*:*:*:*
oracle weblogic_server 14.1.1.0.0 - - cpe:2.3:a:oracle:weblogic_server:14.1.1.0.0:*:*:*:*:*:*:*
netapp h300s_firmware - - - cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:*
netapp h500s_firmware - - - cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:*
netapp h700s_firmware - - - cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:*
netapp h300e_firmware - - - cpe:2.3:o:netapp:h300e_firmware:-:*:*:*:*:*:*:*
netapp h500e_firmware - - - cpe:2.3:o:netapp:h500e_firmware:-:*:*:*:*:*:*:*
netapp h700e_firmware - - - cpe:2.3:o:netapp:h700e_firmware:-:*:*:*:*:*:*:*
netapp h410s_firmware - - - cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:*
netapp h410c_firmware - - - cpe:2.3:o:netapp:h410c_firmware:-:*:*:*:*:*:*:*
netapp active_iq_unified_manager - - - cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:linux:*:*
netapp cloud_backup - - - cpe:2.3:a:netapp:cloud_backup:-:*:*:*:*:*:*:*
netapp cloud_insights_storage_workload_security_agent - - - cpe:2.3:a:netapp:cloud_insights_storage_workload_security_agent:-:*:*:*:*:*:*:*
netapp hci_baseboard_management_controller - - - cpe:2.3:a:netapp:hci_baseboard_management_controller:-:*:*:*:*:*:*:*
netapp max_data - - - cpe:2.3:a:netapp:max_data:-:*:*:*:*:*:*:*
netapp oncommand_insight - - - cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:*
netapp oncommand_system_manager * - - cpe:2.3:a:netapp:oncommand_system_manager:*:*:*:*:*:*:*:*
netapp snap_creator_framework - - - cpe:2.3:a:netapp:snap_creator_framework:-:*:*:*:*:*:*:*
netapp snapcenter_server - - - cpe:2.3:a:netapp:snapcenter_server:-:*:*:*:*:*:*:*
tenable log_correlation_engine * - - cpe:2.3:a:tenable:log_correlation_engine:*:*:*:*:*:*:*:*
解决方案
中文解决方案:
（暂无数据）
英文解决方案:
（暂无数据）
临时解决方案:
（暂无数据）
参考链接
DSA-4693 vendor-advisory
cve.org
访问
FEDORA-2020-36d2db5f51 vendor-advisory
cve.org
访问
无标题 OTHER
cve.org
访问
无标题 OTHER
cve.org
访问
无标题 OTHER
cve.org
访问
无标题 OTHER
cve.org
访问
无标题 OTHER
cve.org
访问
无标题 OTHER
cve.org
访问
openSUSE-SU-2020:1060 vendor-advisory
cve.org
访问
GLSA-202007-03 vendor-advisory
cve.org
访问
openSUSE-SU-2020:1106 vendor-advisory
cve.org
访问
[hive-issues] 20200813 [jira] [Assigned] (HIVE-24039) update jquery version to mitigate CVE-2020-11023 mailing-list
cve.org
访问
[hive-dev] 20200813 [jira] [Created] (HIVE-24039) update jquery version to mitigate CVE-2020-11023 mailing-list
cve.org
访问
[hive-issues] 20200813 [jira] [Updated] (HIVE-24039) Update jquery version to mitigate CVE-2020-11023 mailing-list
cve.org
访问
[hive-gitbox] 20200813 [GitHub] [hive] rajkrrsingh opened a new pull request #1403: Hive 24039 : Update jquery version to mitigate CVE-2020-11023 mailing-list
cve.org
访问
[hive-issues] 20200902 [jira] [Work started] (HIVE-24039) Update jquery version to mitigate CVE-2020-11023 mailing-list
cve.org
访问
[hive-issues] 20200902 [jira] [Commented] (HIVE-24039) Update jquery version to mitigate CVE-2020-11023 mailing-list
cve.org
访问
[hive-issues] 20200902 [jira] [Assigned] (HIVE-24039) Update jquery version to mitigate CVE-2020-11023 mailing-list
cve.org
访问
[hive-issues] 20200902 [jira] [Comment Edited] (HIVE-24039) Update jquery version to mitigate CVE-2020-11023 mailing-list
cve.org
访问
[hive-issues] 20200904 [jira] [Assigned] (HIVE-24039) Update jquery version to mitigate CVE-2020-11023 mailing-list
cve.org
访问
[hive-gitbox] 20200911 [GitHub] [hive] rajkrrsingh closed pull request #1403: Hive 24039 : Update jquery version to mitigate CVE-2020-11023 mailing-list
cve.org
访问
[hive-gitbox] 20200911 [GitHub] [hive] rajkrrsingh opened a new pull request #1403: Hive 24039 : Update jquery version to mitigate CVE-2020-11023 mailing-list
cve.org
访问
[hive-gitbox] 20200912 [GitHub] [hive] rajkrrsingh closed pull request #1403: Hive 24039 : Update jquery version to mitigate CVE-2020-11023 mailing-list
cve.org
访问
[hive-gitbox] 20200912 [GitHub] [hive] rajkrrsingh opened a new pull request #1403: Hive 24039 : Update jquery version to mitigate CVE-2020-11023 mailing-list
cve.org
访问
FEDORA-2020-fbb94073a1 vendor-advisory
cve.org
访问
FEDORA-2020-0b32a59b54 vendor-advisory
cve.org
访问
[hive-issues] 20200915 [jira] [Resolved] (HIVE-24039) Update jquery version to mitigate CVE-2020-11023 mailing-list
cve.org
访问
[hive-commits] 20200915 [hive] branch master updated: HIVE-24039 : Update jquery version to mitigate CVE-2020-11023 (#1403) mailing-list
cve.org
访问
[hive-issues] 20200915 [jira] [Work logged] (HIVE-24039) Update jquery version to mitigate CVE-2020-11023 mailing-list
cve.org
访问
[hive-gitbox] 20200915 [GitHub] [hive] kgyrtkirk merged pull request #1403: HIVE-24039 : Update jquery version to mitigate CVE-2020-11023 mailing-list
cve.org
访问
[hive-issues] 20200915 [jira] [Updated] (HIVE-24039) Update jquery version to mitigate CVE-2020-11023 mailing-list
cve.org
访问
FEDORA-2020-fe94df8c34 vendor-advisory
cve.org
访问
[nifi-commits] 20200930 svn commit: r1882168 - /nifi/site/trunk/security.html mailing-list
cve.org
访问
无标题 OTHER
cve.org
访问
[flink-issues] 20201105 [jira] [Created] (FLINK-20014) Resolve CVE-2020-11022 and CVE-2020-11023 in scala-compiler mailing-list
cve.org
访问
[flink-dev] 20201105 [jira] [Created] (FLINK-20014) Resolve CVE-2020-11022 and CVE-2020-11023 in scala-compiler mailing-list
cve.org
访问
openSUSE-SU-2020:1888 vendor-advisory
cve.org
访问
[flink-issues] 20201129 [jira] [Commented] (FLINK-20014) Resolve CVE-2020-11022 and CVE-2020-11023 in scala-compiler mailing-list
cve.org
访问
[felix-dev] 20201208 [jira] [Created] (FELIX-6366) 1.0.3 < jQuery <3.4.0 is vulnerable to CVE-2020-11023 mailing-list
cve.org
访问
[felix-dev] 20201208 [jira] [Updated] (FELIX-6366) 1.0.3 < jQuery <3.4.0 is vulnerable to CVE-2020-11023 mailing-list
cve.org
访问
[felix-dev] 20201208 [GitHub] [felix-dev] cziegeler merged pull request #64: FELIX-6366 1.0.3 < jQuery <3.4.0 is vulnerable to CVE-2020-11023 mailing-list
cve.org
访问
[felix-dev] 20201208 [GitHub] [felix-dev] abhishekgarg18 opened a new pull request #64: FELIX-6366 1.0.3 < jQuery <3.4.0 is vulnerable to CVE-2020-11023 mailing-list
cve.org
访问
[felix-dev] 20201208 [jira] [Commented] (FELIX-6366) 1.0.3 < jQuery <3.4.0 is vulnerable to CVE-2020-11023 mailing-list
cve.org
访问
[felix-dev] 20201208 [jira] [Assigned] (FELIX-6366) 1.0.3 < jQuery <3.4.0 is vulnerable to CVE-2020-11023 mailing-list
cve.org
访问
[felix-commits] 20201208 [felix-dev] branch master updated: FELIX-6366 1.0.3 < jQuery <3.4.0 is vulnerable to CVE-2020-11023 (#64) mailing-list
cve.org
访问
[felix-dev] 20201208 [jira] [Updated] (FELIX-6366) 1.0.3 < jQuery <3.5.0 is vulnerable to CVE-2020-11023 mailing-list
cve.org
访问
无标题 OTHER
cve.org
访问
[flink-issues] 20210209 [jira] [Commented] (FLINK-20014) Resolve CVE-2020-11022 and CVE-2020-11023 in scala-compiler mailing-list
cve.org
访问
[flink-issues] 20210209 [jira] [Comment Edited] (FLINK-20014) Resolve CVE-2020-11022 and CVE-2020-11023 in scala-compiler mailing-list
cve.org
访问
[debian-lts-announce] 20210326 [SECURITY] [DLA 2608-1] jquery security update mailing-list
cve.org
访问
[flink-issues] 20210422 [jira] [Updated] (FLINK-20014) Resolve CVE-2020-11022 and CVE-2020-11023 in scala-compiler mailing-list
cve.org
访问
[flink-issues] 20210422 [jira] [Commented] (FLINK-20014) Resolve CVE-2020-11022 and CVE-2020-11023 in scala-compiler mailing-list
cve.org
访问
[flink-issues] 20210429 [jira] [Commented] (FLINK-20014) Resolve CVE-2020-11022 and CVE-2020-11023 in scala-compiler mailing-list
cve.org
访问
[flink-issues] 20210429 [jira] [Updated] (FLINK-20014) Resolve CVE-2020-11022 and CVE-2020-11023 in scala-compiler mailing-list
cve.org
访问
无标题 OTHER
cve.org
访问
无标题 OTHER
cve.org
访问
无标题 OTHER
cve.org
访问
无标题 OTHER
cve.org
访问
无标题 OTHER
cve.org
访问
无标题 OTHER
cve.org
访问
[flink-issues] 20211031 [jira] [Updated] (FLINK-20014) Resolve CVE-2020-11022 and CVE-2020-11023 in scala-compiler mailing-list
cve.org
访问
无标题 OTHER
cve.org
访问
无标题 OTHER
cve.org
访问
无标题 OTHER
cve.org
访问
[debian-lts-announce] 20230831 [SECURITY] [DLA 3551-1] otrs2 security update mailing-list
cve.org
访问
af854a3a-2127-422b-91ae-364da2661108 OTHER
nvd.nist.gov
访问
134c704f-9b21-4f2e-91b3-4a467353bcc0 OTHER
nvd.nist.gov
访问
ExploitDB EDB-49767 EXPLOIT
exploitdb
访问
Download Exploit EDB-49767 EXPLOIT
exploitdb
访问
CVE Reference: CVE-2020-11023 ADVISORY
cve.org
访问
CVSS评分详情
3.1 (cna)
MEDIUM
6.9
CVSS向量: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N
机密性
HIGH
完整性
LOW
可用性
NONE
时间信息
发布时间:
2020-04-29 00:00:00
修改时间:
2025-10-21 23:35:45
创建时间:
2025-11-11 15:35:57
更新时间:
2025-11-11 16:57:38
利用信息
此漏洞有可利用代码！
利用代码数量: 1
利用来源:
未知
数据源详情
数据源 记录ID 版本 提取时间
CVE cve_CVE-2020-11023 2025-11-11 15:20:20 2025-11-11 07:35:57
NVD nvd_CVE-2020-11023 2025-11-11 14:56:58 2025-11-11 07:44:25
CNNVD cnnvd_CNNVD-202004-2420 2025-11-11 15:10:25 2025-11-11 07:55:58
EXPLOITDB exploitdb_EDB-49767 2025-11-11 15:05:29 2025-11-11 08:57:38
版本与语言
当前版本: v4
主要语言: EN
支持语言:
EN ZH
其他标识符:
:
:
安全公告
暂无安全公告信息
变更历史
v4 EXPLOITDB
2025-11-11 16:57:38
references_count: 67 → 70; tags_count: 0 → 3; data_sources: ['cnnvd', 'cve', 'nvd'] → ['cnnvd', 'cve', 'exploitdb', 'nvd']
查看详细变更
  • references_count: 67 -> 70
  • tags_count: 0 -> 3
  • data_sources: ['cnnvd', 'cve', 'nvd'] -> ['cnnvd', 'cve', 'exploitdb', 'nvd']
v3 CNNVD
2025-11-11 15:55:58
vulnerability_type: 未提取 → 跨站脚本; cnnvd_id: 未提取 → CNNVD-202004-2420; data_sources: ['cve', 'nvd'] → ['cnnvd', 'cve', 'nvd']
查看详细变更
  • vulnerability_type: 未提取 -> 跨站脚本
  • cnnvd_id: 未提取 -> CNNVD-202004-2420
  • data_sources: ['cve', 'nvd'] -> ['cnnvd', 'cve', 'nvd']
v2 NVD
2025-11-11 15:44:25
affected_products_count: 1 → 75; references_count: 65 → 67; data_sources: ['cve'] → ['cve', 'nvd']
查看详细变更
  • affected_products_count: 1 -> 75
  • references_count: 65 -> 67
  • data_sources: ['cve'] -> ['cve', 'nvd']