CVE Feed

    Dashboard / CVE / CVE-2020-11022

    CVE-2020-11022

    In jQuery starting with 1.12.0 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.

    Published:Apr 23, 2020
    Last Modified:Apr 13, 2026
    EPS:Apr 29, 2020
    EPSS Score:0.02136
    CVSS Score:6.9

    Affected Products

    Vendor
    Debian
    Product
    Debian Linux
    Vendor
    Drupal
    Product
    Drupal
    Vendor
    Fedoraproject
    Product
    Fedora
    Vendor
    Jquery
    Product
    Jquery
    Vendor
    Netapp
    Product
    H300e
    Vendor
    Netapp
    Product
    H300e Firmware
    Vendor
    Netapp
    Product
    H300s
    Vendor
    Netapp
    Product
    H300s Firmware
    Vendor
    Netapp
    Product
    H410c
    Vendor
    Netapp
    Product
    H410c Firmware
    Vendor
    Netapp
    Product
    H410s
    Vendor
    Netapp
    Product
    H410s Firmware
    Vendor
    Netapp
    Product
    H500e
    Vendor
    Netapp
    Product
    H500e Firmware
    Vendor
    Netapp
    Product
    H500s
    Vendor
    Netapp
    Product
    H500s Firmware
    Vendor
    Netapp
    Product
    H700e
    Vendor
    Netapp
    Product
    H700e Firmware
    Vendor
    Netapp
    Product
    H700s
    Vendor
    Netapp
    Product
    H700s Firmware
    Vendor
    Netapp
    Product
    Max Data
    Vendor
    Netapp
    Product
    Oncommand Insight
    Vendor
    Netapp
    Product
    Oncommand System Manager
    Vendor
    Netapp
    Product
    Snap Creator Framework
    Vendor
    Netapp
    Product
    Snapcenter
    Vendor
    Opensuse
    Product
    Leap
    Vendor
    Oracle
    Product
    Agile Product Lifecycle Management For Process
    Vendor
    Oracle
    Product
    Agile Product Supplier Collaboration For Process
    Vendor
    Oracle
    Product
    Application Testing Suite
    Vendor
    Oracle
    Product
    Banking Digital Experience
    Vendor
    Oracle
    Product
    Blockchain Platform
    Vendor
    Oracle
    Product
    Communications Application Session Controller
    Vendor
    Oracle
    Product
    Communications Billing And Revenue Management
    Vendor
    Oracle
    Product
    Communications Diameter Signaling Router Idih\
    Vendor
    Oracle
    Product
    Communications Eagle Application Processor
    Vendor
    Oracle
    Product
    Communications Services Gatekeeper
    Vendor
    Oracle
    Product
    Communications Webrtc Session Controller
    Vendor
    Oracle
    Product
    Enterprise Manager Ops Center
    Vendor
    Oracle
    Product
    Enterprise Session Border Controller
    Vendor
    Oracle
    Product
    Financial Services Analytical Applications Infrastructure
    Vendor
    Oracle
    Product
    Financial Services Analytical Applications Reconciliation Framework
    Vendor
    Oracle
    Product
    Financial Services Asset Liability Management
    Vendor
    Oracle
    Product
    Financial Services Balance Sheet Planning
    Vendor
    Oracle
    Product
    Financial Services Basel Regulatory Capital Basic
    Vendor
    Oracle
    Product
    Financial Services Basel Regulatory Capital Internal Ratings Based Approach
    Vendor
    Oracle
    Product
    Financial Services Data Foundation
    Vendor
    Oracle
    Product
    Financial Services Data Governance For Us Regulatory Reporting
    Vendor
    Oracle
    Product
    Financial Services Data Integration Hub
    Vendor
    Oracle
    Product
    Financial Services Funds Transfer Pricing
    Vendor
    Oracle
    Product
    Financial Services Hedge Management And Ifrs Valuations
    Vendor
    Oracle
    Product
    Financial Services Institutional Performance Analytics
    Vendor
    Oracle
    Product
    Financial Services Liquidity Risk Management
    Vendor
    Oracle
    Product
    Financial Services Liquidity Risk Measurement And Management
    Vendor
    Oracle
    Product
    Financial Services Loan Loss Forecasting And Provisioning
    Vendor
    Oracle
    Product
    Financial Services Market Risk Measurement And Management
    Vendor
    Oracle
    Product
    Financial Services Price Creation And Discovery
    Vendor
    Oracle
    Product
    Financial Services Profitability Management
    Vendor
    Oracle
    Product
    Financial Services Regulatory Reporting For European Banking Authority
    Vendor
    Oracle
    Product
    Financial Services Regulatory Reporting For Us Federal Reserve
    Vendor
    Oracle
    Product
    Healthcare Foundation
    Vendor
    Oracle
    Product
    Hospitality Materials Control
    Vendor
    Oracle
    Product
    Hospitality Simphony
    Vendor
    Oracle
    Product
    Insurance Accounting Analyzer
    Vendor
    Oracle
    Product
    Insurance Allocation Manager For Enterprise Profitability
    Vendor
    Oracle
    Product
    Insurance Data Foundation
    Vendor
    Oracle
    Product
    Insurance Insbridge Rating And Underwriting
    Vendor
    Oracle
    Product
    Jdeveloper
    Vendor
    Oracle
    Product
    Peoplesoft Enterprise Peopletools
    Vendor
    Oracle
    Product
    Policy Automation
    Vendor
    Oracle
    Product
    Policy Automation Connector For Siebel
    Vendor
    Oracle
    Product
    Policy Automation For Mobile Devices
    Vendor
    Oracle
    Product
    Retail Back Office
    Vendor
    Oracle
    Product
    Retail Customer Management And Segmentation Foundation
    Vendor
    Oracle
    Product
    Retail Returns Management
    Vendor
    Oracle
    Product
    Siebel Ui Framework
    Vendor
    Oracle
    Product
    Storagetek Acsls
    Vendor
    Oracle
    Product
    Weblogic Server
    Vendor
    Redhat
    Product
    Amq Interconnect
    Vendor
    Redhat
    Product
    Ansible Tower
    Vendor
    Redhat
    Product
    Enterprise Linux
    Vendor
    Redhat
    Product
    Jboss Enterprise Application Platform
    Vendor
    Redhat
    Product
    Jboss Single Sign On
    Vendor
    Redhat
    Product
    Openshift
    Vendor
    Redhat
    Product
    Red Hat Single Sign On
    Vendor
    Redhat
    Product
    Rhev Manager
    Vendor
    Redhat
    Product
    Rhosemc
    Vendor
    Redhat
    Product
    Service Mesh
    Vendor
    Tenable
    Product
    Log Correlation Engine

    Exploits

    http://packetstormsecurity.com/files/162159/jQuery-1.2-Cross-Site-Scripting.htmlhttps://www.exploit-db.com/exploits/49766https://github.com/0xAJ2K/CVE-2020-11022-CVE-2020-11023https://github.com/ibnurusdianto/CVE-2020-11022https://github.com/okni2k/HW-Pyton-10https://github.com/Snorlyd/https-nj.gov---CVE-2020-11022

    Related CVEs

    CVE-2026-77118 (CVSS 8.4) — A heap out-of-bounds write exists in the Photo CD (PCD) decoder of GraphicsMagick. In DecodeImage() (coders/pc…
    CVE-2026-56968 (CVSS 3.7) — GNU SASL before 2.2.4 lacks sanitization of a short challenge in _gsasl_ntlm_client_step in the NTLM client, w…
    CVE-2026-49975 (CVSS 7.5) — Memory Allocation with Excessive Size Value vulnerability in Apache HTTP Server's mod_http leads to denial of …
    CVE-2026-9256 (CVSS 9.2) — NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This vulnerabilit…
    CVE-2026-31431 (CVSS 7.8) — In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating …
    CVE-2026-34757 (CVSS 5.1) — LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network …
    CVE-2026-4775 (CVSS 7.8) — A flaw was found in the libtiff library. A remote attacker could exploit a signed integer overflow vulnerabili…
    CVE-2025-63261 (CVSS 7.8) — AWStats 8.0 is vulnerable to Command Injection via the open function…
    CVE-2026-3497 (CVSS 6.9) — Vulnerability in the OpenSSH GSSAPI delta included in various Linux distributions. This vulnerability affects …
    CVE-2026-1940 (CVSS 5.1) — An incomplete fix for CVE-2024-47778 allows an out-of-bounds read in gst_wavparse_adtl_chunk() function. The p…

    References

    http://security.netapp.com/advisory/ntap-20200511-0006
    https://blog.jquery.com/2020/04/10/jquery-3-5-0-released
    https://github.com/jquery/jquery/commit/1d61fd9407e6fbe82fe55cb0b938307aa0791f77
    https://github.com/jquery/jquery/releases/tag/3.5.0
    https://github.com/jquery/jquery/security/advisories/GHSA-gxr4-xjj5-5px2
    https://github.com/maximebf/php-debugbar/commit/847216e60544258c881f2733d699bbcfeefac0fc
    https://github.com/maximebf/php-debugbar/issues/447
    https://github.com/rubysec/ruby-advisory-db/blob/master/gems/jquery-rails/CVE-2020-11022.yml
    https://jquery.com/upgrade-guide/3.5
    https://lists.apache.org/thread.html/r0483ba0072783c2e1bfea613984bfb3c86e73ba8879d780dc1cc7d36@%3Cissues.flink.apache.org%3E
    https://lists.apache.org/thread.html/r49ce4243b4738dd763caeb27fa8ad6afb426ae3e8c011ff00b8b1f48@%3Cissues.flink.apache.org%3E
    https://lists.apache.org/thread.html/r54565a8f025c7c4f305355fdfd75b68eca442eebdb5f31c2e7d977ae@%3Cissues.flink.apache.org%3E
    https://lists.apache.org/thread.html/r564585d97bc069137e64f521e68ba490c7c9c5b342df5d73c49a0760@%3Cissues.flink.apache.org%3E
    https://lists.apache.org/thread.html/r706cfbc098420f7113968cc377247ec3d1439bce42e679c11c609e2d@%3Cissues.flink.apache.org%3E
    https://lists.apache.org/thread.html/r8f70b0f65d6bedf316ecd899371fd89e65333bc988f6326d2956735c@%3Cissues.flink.apache.org%3E
    https://lists.apache.org/thread.html/rbb448222ba62c430e21e13f940be4cb5cfc373cd3bce56b48c0ffa67@%3Cdev.flink.apache.org%3E
    https://lists.apache.org/thread.html/rdf44341677cf7eec7e9aa96dcf3f37ed709544863d619cca8c36f133@%3Ccommits.airflow.apache.org%3E
    https://lists.apache.org/thread.html/re4ae96fa5c1a2fe71ccbb7b7ac1538bd0cb677be270a2bf6e2f8d108@%3Cissues.flink.apache.org%3E
    https://lists.apache.org/thread.html/rede9cfaa756e050a3d83045008f84a62802fc68c17f2b4eabeaae5e4@%3Cissues.flink.apache.org%3E
    https://lists.apache.org/thread.html/ree3bd8ddb23df5fa4e372d11c226830ea3650056b1059f3965b3fce2@%3Cissues.flink.apache.org%3E
    https://lists.debian.org/debian-lts-announce/2021/03/msg00033.html
    https://lists.debian.org/debian-lts-announce/2023/08/msg00040.html
    https://lists.fedoraproject.org/archives/list/[email protected]/message/AVKYXLWCLZBV2N7M46KYK4LVA5OXWPBY
    https://lists.fedoraproject.org/archives/list/[email protected]/message/QPN2L2XVQGUA2V5HNQJWHK3APSK3VN7K
    https://lists.fedoraproject.org/archives/list/[email protected]/message/SAPQVX3XDNPGFT26QAQ6AJIXZZBZ4CD4
    https://lists.fedoraproject.org/archives/list/[email protected]/message/SFP4UK4EGP4AFH2MWYJ5A5Z4I7XVFQ6B
    https://lists.fedoraproject.org/archives/list/[email protected]/message/VOE7P7APPRQKD4FGNHBKJPDY6FFCOH3W
    https://lists.opensuse.org/opensuse-security-announce/2020-07/msg00067.html
    https://lists.opensuse.org/opensuse-security-announce/2020-07/msg00085.html
    https://lists.opensuse.org/opensuse-security-announce/2020-11/msg00039.html
    https://packetstormsecurity.com/files/162159/jQuery-1.2-Cross-Site-Scripting.html
    https://security.gentoo.org/glsa/202007-03
    https://www.debian.org/security/2020/dsa-4693
    https://www.drupal.org/sa-core-2020-002
    https://www.oracle.com/security-alerts/cpuApr2021.html
    https://www.oracle.com/security-alerts/cpuapr2022.html
    https://www.oracle.com/security-alerts/cpujan2021.html
    https://www.oracle.com/security-alerts/cpujan2022.html
    https://www.oracle.com/security-alerts/cpujul2020.html
    https://www.oracle.com/security-alerts/cpujul2021.html
    https://www.oracle.com/security-alerts/cpujul2022.html
    https://www.oracle.com/security-alerts/cpuoct2020.html
    https://www.oracle.com/security-alerts/cpuoct2021.html
    https://www.tenable.com/security/tns-2020-10
    https://www.tenable.com/security/tns-2020-11
    https://www.tenable.com/security/tns-2021-02
    https://www.tenable.com/security/tns-2021-10
    http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00067.html
    http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00085.html
    http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00039.html
    http://packetstormsecurity.com/files/162159/jQuery-1.2-Cross-Site-Scripting.html
    https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/
    https://github.com/jquery/jquery/commit/1d61fd9407e6fbe82fe55cb0b938307aa0791f77
    https://github.com/jquery/jquery/security/advisories/GHSA-gxr4-xjj5-5px2
    https://jquery.com/upgrade-guide/3.5/
    https://lists.apache.org/thread.html/r0483ba0072783c2e1bfea613984bfb3c86e73ba8879d780dc1cc7d36%40%3Cissues.flink.apache.org%3E
    https://lists.apache.org/thread.html/r49ce4243b4738dd763caeb27fa8ad6afb426ae3e8c011ff00b8b1f48%40%3Cissues.flink.apache.org%3E
    https://lists.apache.org/thread.html/r54565a8f025c7c4f305355fdfd75b68eca442eebdb5f31c2e7d977ae%40%3Cissues.flink.apache.org%3E
    https://lists.apache.org/thread.html/r564585d97bc069137e64f521e68ba490c7c9c5b342df5d73c49a0760%40%3Cissues.flink.apache.org%3E
    https://lists.apache.org/thread.html/r706cfbc098420f7113968cc377247ec3d1439bce42e679c11c609e2d%40%3Cissues.flink.apache.org%3E
    https://lists.apache.org/thread.html/r8f70b0f65d6bedf316ecd899371fd89e65333bc988f6326d2956735c%40%3Cissues.flink.apache.org%3E
    https://lists.apache.org/thread.html/rbb448222ba62c430e21e13f940be4cb5cfc373cd3bce56b48c0ffa67%40%3Cdev.flink.apache.org%3E
    https://lists.apache.org/thread.html/rdf44341677cf7eec7e9aa96dcf3f37ed709544863d619cca8c36f133%40%3Ccommits.airflow.apache.org%3E
    https://lists.apache.org/thread.html/re4ae96fa5c1a2fe71ccbb7b7ac1538bd0cb677be270a2bf6e2f8d108%40%3Cissues.flink.apache.org%3E
    https://lists.apache.org/thread.html/rede9cfaa756e050a3d83045008f84a62802fc68c17f2b4eabeaae5e4%40%3Cissues.flink.apache.org%3E
    https://lists.apache.org/thread.html/ree3bd8ddb23df5fa4e372d11c226830ea3650056b1059f3965b3fce2%40%3Cissues.flink.apache.org%3E
    https://lists.debian.org/debian-lts-announce/2021/03/msg00033.html
    https://lists.debian.org/debian-lts-announce/2023/08/msg00040.html
    https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AVKYXLWCLZBV2N7M46KYK4LVA5OXWPBY/
    https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QPN2L2XVQGUA2V5HNQJWHK3APSK3VN7K/
    https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SAPQVX3XDNPGFT26QAQ6AJIXZZBZ4CD4/
    https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SFP4UK4EGP4AFH2MWYJ5A5Z4I7XVFQ6B/
    https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VOE7P7APPRQKD4FGNHBKJPDY6FFCOH3W/
    https://security.gentoo.org/glsa/202007-03
    https://security.netapp.com/advisory/ntap-20200511-0006/
    https://www.debian.org/security/2020/dsa-4693
    https://www.drupal.org/sa-core-2020-002
    https://www.oracle.com//security-alerts/cpujul2021.html
    https://www.oracle.com/security-alerts/cpuApr2021.html
    https://www.oracle.com/security-alerts/cpuapr2022.html
    https://www.oracle.com/security-alerts/cpujan2021.html
    https://www.oracle.com/security-alerts/cpujan2022.html
    https://www.oracle.com/security-alerts/cpujul2020.html
    https://www.oracle.com/security-alerts/cpujul2022.html
    https://www.oracle.com/security-alerts/cpuoct2020.html
    https://www.oracle.com/security-alerts/cpuoct2021.html
    https://www.tenable.com/security/tns-2020-10
    https://www.tenable.com/security/tns-2020-11
    https://www.tenable.com/security/tns-2021-02
    https://www.tenable.com/security/tns-2021-10

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High