CVE-2020-11023

MEDIUM(6.9)KEVLikely Exploited

JQuery Cross-Site Scripting (XSS) Vulnerability

Description

CVE-2020-11023 is a medium-severity cross-site scripting (XSS) vulnerability in jQuery versions 1.0.3 through 3.4.x that allows attackers to execute arbitrary JavaScript in the context of a victim's browser session. With a CVSS v3.1 base score of 6.9, the flaw exists in jQuery's DOM manipulation methods (.html(), .append(), and others) where passing HTML containing

KEV Information

Vendor
JQuery
Product
JQuery
Date Added
January 23, 2025
Due Date
February 13, 2025
Required Action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

CVSS Score

Vector String
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:NOpen in Calculator
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
LOW
Availability Impact
NONE
Exploitability Score
1.6
Impact Score
4.7

CWEs

CWE-79Cross-site Scripting (XSS)

Improper Neutralization of Input During Web Page Generation

Affected Products

VendorProductVersion
jqueryjquery>= 1.0.3, < 3.5.0
debiandebian linux9.0
fedoraprojectfedora31; 32; 33
drupaldrupal>= 7.0, < 7.70; >= 8.7.0, < 8.7.14; >= 8.8.0, < 8.8.6
oracleapplication express< 20.2
oracleapplication testing suite13.3.0.1
oraclebanking enterprise collections>= 2.7.0, <= 2.8.0
oraclebanking platform>= 2.4.0, <= 2.10.0
oracleblockchain platform< 21.1.2; 21.1.2
oraclebusiness intelligence5.9.0.0.0
oraclecommunications analytics12.1.1
oraclecommunications eagle application processor>= 16.1.0, <= 16.4.0
oraclecommunications element manager8.1.1; 8.2.0; 8.2.1
oraclecommunications interactive session recorder>= 6.1, <= 6.4
oraclecommunications operations monitor>= 4.1, <= 4.3; 3.4
oraclecommunications services gatekeeper7.0
oraclecommunications session report manager8.1.1; 8.2.0; 8.2.1
oraclecommunications session route manager8.1.1; 8.2.0; 8.2.1
oraclefinancial services regulatory reporting for de nederlandsche bank8.0.4
oraclefinancial services revenue management and billing analytics2.7; 2.8

Multiple CVSS Assessments

Source: [email protected](Secondary)
6.9
MEDIUM

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N

Source: [email protected](Primary)
6.1
MEDIUM

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References

Weakness Type

Unknown CWE

CVE-2020-11023 does not have a specific CWE assigned in the NVD database, but the vulnerability is a cross-site scripting (XSS) flaw rooted in improper handling of HTML content within jQuery's DOM manipulation methods. When untrusted HTML containing

Impact Analysis

The impact of CVE-2020-11023 primarily affects confidentiality with a high rating, and includes a low integrity impact, while availability is not directly affected. Confidentiality is significantly compromised because successful XSS exploitation allows attackers to steal session cookies, authentication tokens, and other sensitive data from the victim's browser. The changed scope (S:C) in the CVSS vector means the XSS payload executes in the victim's browser context, potentially accessing data from the vulnerable web application and any other applications sharing the same origin.

Integrity receives a low impact rating because while the attacker can modify page content and inject malicious elements visible to the user, the modification is limited to the client side and does not directly alter server-side data. However, the attacker can use the XSS to perform actions on behalf of the victim, submit forms, and trigger state-changing operations that indirectly affect data integrity.

The true severity of CVE-2020-11023 lies in the extraordinary scope of affected systems. jQuery is the most widely deployed JavaScript library in web history, and the vulnerability spans versions from 1.0.3 through 3.4.x — covering nearly two decades of releases. The EPSS score of 36.28% at the 97.0th percentile confirms massive exploitation activity. The affected ecosystem extends far beyond jQuery itself: Drupal versions 7 through 8.8.6 are affected, along with dozens of Oracle products including database management tools, middleware, and enterprise applications. Debian, Fedora, and other Linux distributions have issued advisories. A public exploit is available on Packet Storm Security, further lowering the exploitation barrier.

Exploit Maturity

CVE-2020-11023 demonstrates high exploit maturity with public exploit code available and active exploitation confirmed through its inclusion in CISA's Known Exploited Vulnerabilities catalog with a remediation deadline of February 13, 2025. The EPSS score of 36.28% at the 97.0th percentile reflects pervasive exploitation activity. A public exploit is available at Packet Storm Security, and the jQuery team has published detailed information in their security advisory (GHSA-jpcq-cgw6-v4j6).

The vulnerability's inclusion in the KEV catalog in 2025, five years after disclosure, underscores the persistent challenge of updating jQuery across the millions of websites and applications that depend on it. Many legacy applications, content management systems, and enterprise platforms still ship with vulnerable jQuery versions. The fix was introduced in jQuery 3.5.0, and the upgrade guide documents the changes. Major platforms including Drupal issued emergency updates (SA-CORE-2020-002), and Oracle has addressed the vulnerability across dozens of products in multiple quarterly security updates. The CISA KEV entry can be reviewed at the KEV catalog. The ransomware association is unknown, but XSS vulnerabilities in widely deployed libraries are valuable for credential theft, watering hole attacks, and initial access campaigns.

Remediation

  1. Upgrade jQuery to version 3.5.0 or later across all web applications and websites. Review the jQuery 3.5.0 release notes and upgrade guide for breaking changes that may affect application functionality. Test thoroughly after upgrading, as the fix changes how jQuery processes HTML during DOM manipulation.

  2. Update frameworks and platforms that bundle jQuery to versions that include the patched library. For Drupal, upgrade to versions 7.70, 8.7.14, or 8.8.6 or later. For Oracle products, apply the relevant Critical Patch Update. Check all CMS platforms, JavaScript frameworks, and enterprise applications for jQuery dependency updates.

  3. Implement Content Security Policy (CSP) headers as a defense-in-depth measure to mitigate XSS exploitation even on pages that still use vulnerable jQuery versions. Configure CSP to restrict script sources using script-src directives and enable nonce-based or hash-based script allowlisting to prevent execution of injected scripts.

  4. Audit all sources of HTML content that are passed to jQuery DOM manipulation methods. Ensure that any user-supplied or third-party HTML is sanitized using a dedicated HTML sanitization library (such as DOMPurify) on the server side before being passed to jQuery methods. Do not rely solely on jQuery's own HTML processing for security.

  5. Inventory all jQuery versions deployed across your web infrastructure using automated scanning tools or browser developer tools. Many applications include jQuery through multiple paths — directly, through CDN includes, through bundled node_modules, or through framework dependencies — and each instance must be individually updated or mitigated.

Technical Details

CVE-2020-11023 is a cross-site scripting vulnerability in jQuery, characterized by the CVSS v3.1 vector CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N. Breaking down the vector components: Attack Vector (AV:N) indicates the vulnerability is exploitable over the network through web pages. Attack Complexity (AC:H) reflects that successful exploitation requires specific conditions — the target application must pass untrusted HTML containing

The technical mechanism involves how jQuery processes HTML strings containing

Frequently Asked Questions

What is CVE-2020-11023?

CVE-2020-11023 is a medium-severity cross-site scripting (XSS) vulnerability in jQuery affecting versions 1.0.3 through 3.4.x. It allows execution of untrusted JavaScript when HTML containing

Why is a 2020 jQuery vulnerability still in CISA's KEV catalog?

jQuery is the most widely deployed JavaScript library in history, and many legacy applications, CMS platforms, and enterprise systems still use vulnerable versions. The continued KEV listing reflects persistent real-world exploitation against the massive install base of unpatched jQuery instances.

Which products are affected beyond jQuery itself?

The vulnerability affects any application using jQuery 1.0.3 through 3.4.x, including Drupal 7 through 8.8.6, dozens of Oracle products, and countless custom web applications. Debian, Fedora, and other Linux distributions have also issued advisories for packages bundling vulnerable jQuery versions.

How do I check if my website uses a vulnerable version of jQuery?

Open your browser developer tools console and type jQuery.fn.jquery or $.fn.jquery to display the jQuery version. If the version is below 3.5.0, you are vulnerable. Note that some pages include multiple jQuery instances, so check all loaded scripts.

CVSS Score

6.9
MEDIUM(6.9)

EPSS Score

EPSS Score83.83%
EPSS Percentile99.7%

Dates

PublishedApril 29, 2020
Last ModifiedJune 17, 2026
StatusAnalyzed
CVSS Versionv3.1

Quick Links

Back to CVE Database

Need Help With Vulnerability Management?

Our security experts can help you prioritize and remediate vulnerabilities effectively.

Get in Touch