CVE-2020-11023

Confirmed PUBLISHED

Potential XSS vulnerability in jQuery

jquery · jQuery

Exploited in the wild PoC available

Recommended Action

Prioritize remediation. Validate affected assets and apply vendor fixes on an accelerated timeline.

View KEV Feed Talk to Sales

Confidence

Confirmed

Exploitation Status

Exploited in the wild

Observed in Sensors

Attempts (30d)

—

Unique Attacker IPs

—

CISA KEV

In CISA KEV

CVSS / EPSS

6.9 Medium

At a Glance

In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.

nessus_scanner cisa

CVE Published: Apr 29, 2020
Exploitation Reported: Jan 23, 2025
CVSS: 6.9 Medium
EPSS: —

Remote Unauthenticated

Affected Versions

Vendor	Product	Version	Status
jquery	jQuery	>= 1.0.3, < 3.5.0	Affected

CVE References

DSA-4693 debian.org · Vendor Advisory https://www.debian.org/security/2020/dsa-4693
FEDORA-2020-36d2db5f51 lists.fedoraproject.org · Vendor Advisory https://lists.fedoraproject.org/archives/list/package-announce%40list...
openSUSE-SU-2020:1060 lists.opensuse.org · Vendor Advisory http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00067...
GLSA-202007-03 security.gentoo.org · Vendor Advisory https://security.gentoo.org/glsa/202007-03
openSUSE-SU-2020:1106 lists.opensuse.org · Vendor Advisory http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00085...

Show 60 more references

FEDORA-2020-fbb94073a1 lists.fedoraproject.org · Vendor Advisory https://lists.fedoraproject.org/archives/list/package-announce%40list...
FEDORA-2020-0b32a59b54 lists.fedoraproject.org · Vendor Advisory https://lists.fedoraproject.org/archives/list/package-announce%40list...
FEDORA-2020-fe94df8c34 lists.fedoraproject.org · Vendor Advisory https://lists.fedoraproject.org/archives/list/package-announce%40list...
openSUSE-SU-2020:1888 lists.opensuse.org · Vendor Advisory http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00039...
[hive-issues] 20200813 [jira] [Assigned] (HIVE-24039) update jquery version to mitigate CVE-2020-11023 lists.apache.org · Mailing List https://lists.apache.org/thread.html/r094f435595582f6b5b24b66fedf8054...
[hive-dev] 20200813 [jira] [Created] (HIVE-24039) update jquery version to mitigate CVE-2020-11023 lists.apache.org · Mailing List https://lists.apache.org/thread.html/rf661a90a15da8da5922ba6127b3f5f8...
[hive-issues] 20200813 [jira] [Updated] (HIVE-24039) Update jquery version to mitigate CVE-2020-11023 lists.apache.org · Mailing List https://lists.apache.org/thread.html/r9c5fda81e4bca8daee305b4c03283dd...
[hive-gitbox] 20200813 [GitHub] [hive] rajkrrsingh opened a new pull request #1403: Hive 24039 : Update jquery version to mitigate CVE-2020-11023 lists.apache.org · Mailing List https://lists.apache.org/thread.html/ra3c9219fcb0b289e18e9ec5a5ebeaa5...
[hive-issues] 20200902 [jira] [Work started] (HIVE-24039) Update jquery version to mitigate CVE-2020-11023 lists.apache.org · Mailing List https://lists.apache.org/thread.html/radcb2aa874a79647789f3563fcbbcea...
[hive-issues] 20200902 [jira] [Commented] (HIVE-24039) Update jquery version to mitigate CVE-2020-11023 lists.apache.org · Mailing List https://lists.apache.org/thread.html/rd38b4185a797b324c8dd940d9213cf9...
[hive-issues] 20200902 [jira] [Assigned] (HIVE-24039) Update jquery version to mitigate CVE-2020-11023 lists.apache.org · Mailing List https://lists.apache.org/thread.html/r6e97b37963926f6059ecc1e41772160...
[hive-issues] 20200902 [jira] [Comment Edited] (HIVE-24039) Update jquery version to mitigate CVE-2020-11023 lists.apache.org · Mailing List https://lists.apache.org/thread.html/rb69b7d8217c1a6a2100247a5d06ce61...
[hive-issues] 20200904 [jira] [Assigned] (HIVE-24039) Update jquery version to mitigate CVE-2020-11023 lists.apache.org · Mailing List https://lists.apache.org/thread.html/r4aadb98086ca72ed75391f54167522d...
[hive-gitbox] 20200911 [GitHub] [hive] rajkrrsingh closed pull request #1403: Hive 24039 : Update jquery version to mitigate CVE-2020-11023 lists.apache.org · Mailing List https://lists.apache.org/thread.html/ra374bb0299b4aa3e04edde01ebc03ed...
[hive-gitbox] 20200911 [GitHub] [hive] rajkrrsingh opened a new pull request #1403: Hive 24039 : Update jquery version to mitigate CVE-2020-11023 lists.apache.org · Mailing List https://lists.apache.org/thread.html/rb25c3bc7418ae75cba07988dafe1b69...
[hive-gitbox] 20200912 [GitHub] [hive] rajkrrsingh closed pull request #1403: Hive 24039 : Update jquery version to mitigate CVE-2020-11023 lists.apache.org · Mailing List https://lists.apache.org/thread.html/rf1ba79e564fe7efc56aef7c986106f1...
[hive-gitbox] 20200912 [GitHub] [hive] rajkrrsingh opened a new pull request #1403: Hive 24039 : Update jquery version to mitigate CVE-2020-11023 lists.apache.org · Mailing List https://lists.apache.org/thread.html/ra32c7103ded9041c7c1cb8c12c8d125...
[hive-issues] 20200915 [jira] [Resolved] (HIVE-24039) Update jquery version to mitigate CVE-2020-11023 lists.apache.org · Mailing List https://lists.apache.org/thread.html/ra406b3adfcffcb5ce8707013bdb7c35...
[hive-commits] 20200915 [hive] branch master updated: HIVE-24039 : Update jquery version to mitigate CVE-2020-11023 (#1403) lists.apache.org · Mailing List https://lists.apache.org/thread.html/rab82dd040f302018c85bd07d33f5604...
[hive-issues] 20200915 [jira] [Work logged] (HIVE-24039) Update jquery version to mitigate CVE-2020-11023 lists.apache.org · Mailing List https://lists.apache.org/thread.html/r6c4df3b33e625a44471009a172dabe6...
[hive-gitbox] 20200915 [GitHub] [hive] kgyrtkirk merged pull request #1403: HIVE-24039 : Update jquery version to mitigate CVE-2020-11023 lists.apache.org · Mailing List https://lists.apache.org/thread.html/r1fed19c860a0d470f2a3eded1279577...
[hive-issues] 20200915 [jira] [Updated] (HIVE-24039) Update jquery version to mitigate CVE-2020-11023 lists.apache.org · Mailing List https://lists.apache.org/thread.html/r0593393ca1e97b1e7e098fe69d414d6...
[nifi-commits] 20200930 svn commit: r1882168 - /nifi/site/trunk/security.html lists.apache.org · Mailing List https://lists.apache.org/thread.html/rda99599896c3667f2cc9e9d34c7b6ef...
[flink-issues] 20201105 [jira] [Created] (FLINK-20014) Resolve CVE-2020-11022 and CVE-2020-11023 in scala-compiler lists.apache.org · Mailing List https://lists.apache.org/thread.html/r706cfbc098420f7113968cc377247ec...
[flink-dev] 20201105 [jira] [Created] (FLINK-20014) Resolve CVE-2020-11022 and CVE-2020-11023 in scala-compiler lists.apache.org · Mailing List https://lists.apache.org/thread.html/rbb448222ba62c430e21e13f940be4cb...
[flink-issues] 20201129 [jira] [Commented] (FLINK-20014) Resolve CVE-2020-11022 and CVE-2020-11023 in scala-compiler lists.apache.org · Mailing List https://lists.apache.org/thread.html/r49ce4243b4738dd763caeb27fa8ad6a...
[felix-dev] 20201208 [jira] [Created] (FELIX-6366) 1.0.3 < jQuery <3.4.0 is vulnerable to CVE-2020-11023 lists.apache.org · Mailing List https://lists.apache.org/thread.html/r2c85121a47442036c7f8353a3724aa0...
[felix-dev] 20201208 [jira] [Updated] (FELIX-6366) 1.0.3 < jQuery <3.4.0 is vulnerable to CVE-2020-11023 lists.apache.org · Mailing List https://lists.apache.org/thread.html/r4dba67be3239b34861f1b9cfdf9dfb3...
[felix-dev] 20201208 [GitHub] [felix-dev] cziegeler merged pull request #64: FELIX-6366 1.0.3 < jQuery <3.4.0 is vulnerable to CVE-2020-11023 lists.apache.org · Mailing List https://lists.apache.org/thread.html/r3702ede0ff83a29ba3eb418f6f11c47...
[felix-dev] 20201208 [GitHub] [felix-dev] abhishekgarg18 opened a new pull request #64: FELIX-6366 1.0.3 < jQuery <3.4.0 is vulnerable to CVE-2020-11023 lists.apache.org · Mailing List https://lists.apache.org/thread.html/r07ab379471fb15644bf7a92e4a98cbc...
[felix-dev] 20201208 [jira] [Commented] (FELIX-6366) 1.0.3 < jQuery <3.4.0 is vulnerable to CVE-2020-11023 lists.apache.org · Mailing List https://lists.apache.org/thread.html/r9e0bd31b7da9e7403478d22652b8760...
[felix-dev] 20201208 [jira] [Assigned] (FELIX-6366) 1.0.3 < jQuery <3.4.0 is vulnerable to CVE-2020-11023 lists.apache.org · Mailing List https://lists.apache.org/thread.html/rf0f8939596081d84be1ae6a91d6248b...
[felix-commits] 20201208 [felix-dev] branch master updated: FELIX-6366 1.0.3 < jQuery <3.4.0 is vulnerable to CVE-2020-11023 (#64) lists.apache.org · Mailing List https://lists.apache.org/thread.html/r9006ad2abf81d02a0ef2126bab51779...
[felix-dev] 20201208 [jira] [Updated] (FELIX-6366) 1.0.3 < jQuery <3.5.0 is vulnerable to CVE-2020-11023 lists.apache.org · Mailing List https://lists.apache.org/thread.html/r55f5e066cc7301e3630ce90bbbf8d28...
[flink-issues] 20210209 [jira] [Commented] (FLINK-20014) Resolve CVE-2020-11022 and CVE-2020-11023 in scala-compiler lists.apache.org · Mailing List https://lists.apache.org/thread.html/r8f70b0f65d6bedf316ecd899371fd89...
[flink-issues] 20210209 [jira] [Comment Edited] (FLINK-20014) Resolve CVE-2020-11022 and CVE-2020-11023 in scala-compiler lists.apache.org · Mailing List https://lists.apache.org/thread.html/r564585d97bc069137e64f521e68ba49...
[debian-lts-announce] 20210326 [SECURITY] [DLA 2608-1] jquery security update lists.debian.org · Mailing List https://lists.debian.org/debian-lts-announce/2021/03/msg00033.html
[flink-issues] 20210422 [jira] [Updated] (FLINK-20014) Resolve CVE-2020-11022 and CVE-2020-11023 in scala-compiler lists.apache.org · Mailing List https://lists.apache.org/thread.html/ree3bd8ddb23df5fa4e372d11c226830...
[flink-issues] 20210422 [jira] [Commented] (FLINK-20014) Resolve CVE-2020-11022 and CVE-2020-11023 in scala-compiler lists.apache.org · Mailing List https://lists.apache.org/thread.html/rede9cfaa756e050a3d83045008f84a6...
[flink-issues] 20210429 [jira] [Commented] (FLINK-20014) Resolve CVE-2020-11022 and CVE-2020-11023 in scala-compiler lists.apache.org · Mailing List https://lists.apache.org/thread.html/r54565a8f025c7c4f305355fdfd75b68...
[flink-issues] 20210429 [jira] [Updated] (FLINK-20014) Resolve CVE-2020-11022 and CVE-2020-11023 in scala-compiler lists.apache.org · Mailing List https://lists.apache.org/thread.html/re4ae96fa5c1a2fe71ccbb7b7ac1538b...
[flink-issues] 20211031 [jira] [Updated] (FLINK-20014) Resolve CVE-2020-11022 and CVE-2020-11023 in scala-compiler lists.apache.org · Mailing List https://lists.apache.org/thread.html/r0483ba0072783c2e1bfea613984bfb3...
[debian-lts-announce] 20230831 [SECURITY] [DLA 3551-1] otrs2 security update lists.debian.org · Mailing List https://lists.debian.org/debian-lts-announce/2023/08/msg00040.html
oracle.com/security-alerts/cpujul2020.html oracle.com · CVE Record https://www.oracle.com/security-alerts/cpujul2020.html
jquery.com/upgrade-guide/3.5 jquery.com · CVE Record https://jquery.com/upgrade-guide/3.5/
security.netapp.com/advisory/ntap-20200511-0006 security.netapp.com · CVE Record https://security.netapp.com/advisory/ntap-20200511-0006/
drupal.org/sa-core-2020-002 drupal.org · CVE Record https://www.drupal.org/sa-core-2020-002
GitHub — jquery/jquery github.com · CVE Record https://github.com/jquery/jquery/security/advisories/GHSA-jpcq-cgw6-v4j6
blog.jquery.com/2020/04/10/jquery-3-5-0-released blog.jquery.com · CVE Record https://blog.jquery.com/2020/04/10/jquery-3-5-0-released
oracle.com/security-alerts/cpuoct2020.html oracle.com · CVE Record https://www.oracle.com/security-alerts/cpuoct2020.html
oracle.com/security-alerts/cpujan2021.html oracle.com · CVE Record https://www.oracle.com/security-alerts/cpujan2021.html
oracle.com/security-alerts/cpuApr2021.html oracle.com · CVE Record https://www.oracle.com/security-alerts/cpuApr2021.html
tenable.com/security/tns-2021-10 tenable.com · CVE Record https://www.tenable.com/security/tns-2021-10
tenable.com/security/tns-2021-02 tenable.com · CVE Record https://www.tenable.com/security/tns-2021-02
packetstormsecurity.com/files/162160/jQuery-1.0.3-Cross-Site-Scripti... packetstormsecurity.com · CVE Record http://packetstormsecurity.com/files/162160/jQuery-1.0.3-Cross-Site-S...
oracle.com//security-alerts/cpujul2021.html oracle.com · CVE Record https://www.oracle.com//security-alerts/cpujul2021.html
oracle.com/security-alerts/cpuoct2021.html oracle.com · CVE Record https://www.oracle.com/security-alerts/cpuoct2021.html
oracle.com/security-alerts/cpujan2022.html oracle.com · CVE Record https://www.oracle.com/security-alerts/cpujan2022.html
oracle.com/security-alerts/cpuapr2022.html oracle.com · CVE Record https://www.oracle.com/security-alerts/cpuapr2022.html
oracle.com/security-alerts/cpujul2022.html oracle.com · CVE Record https://www.oracle.com/security-alerts/cpujul2022.html

Recommended Actions

Prioritize remediation. Validate affected assets and apply vendor fixes on an accelerated timeline.
Check enrichment artifacts for scanner coverage and available PoCs before rolling remediation validation.
Use the Pro API to automate enrichment, telemetry, and workflow delivery for VM, SOC, and CTI pipelines.

Known Exploited Vulnerability Sources

Catalogues that list this CVE as a known exploited vulnerability.

Per-source evidence links for KEV attestations are available through the KEVIntel Pro API.

Learn about Pro API access

Source	Added
CISA First	2025-01-23 00:00 UTC

CVSS Scores

CVSS v3.1 6.9 Medium

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N

Exploitation Status

Exploited in the wild

Recorded 2025-01-23 00:00:00 UTC · CISA

Proof of concept available

Recorded 2024-01-03 02:35:37 UTC · GitHub

Weaknesses (CWE)

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Scanner Integrations

Scanner	Reference	Detected
Nessus	https://www.tenable.com/plugins/nessus/236419	Jun 02, 2025

Potential Proof of Concepts

These PoCs are unverified and could contain malware. Use at your own risk.

Cybernegro/CVE-2020-11023

github · Created 2024-01-03 02:35:37 UTC · 2 stars

CVE-2020-11023 PoC for bug bounty.

Automate This Intelligence with the Pro API

Confidence scoring, exploit status, sensor telemetry, PoCs, scanner integrations, mentions, and tags are available programmatically for VM, SOC, and CTI workflows.

View Pro Pricing View API Docs

Pro API Example

GET /api/v2/pro/kevs/CVE-2020-11023

{
  "cve_id": "CVE-2020-11023",
  "title": "Potential XSS vulnerability in jQuery",
  "affected_vendor": "jquery",
  "affected_product": "jQuery",
  "affected_versions": [
    { "vendor": "...", "product": "...", "status": "affected", "display_label": "..." }
  ],
  "confidence": "Confirmed",
  "cvss_score": 6.9,
  "epss_score": null,
  "exploit_status": {
    "exploited_in_the_wild": true,
    "active_exploitation_observed": false
  },
  "sensor_telemetry": { "...": "Pro API fields" },
  "proof_of_concepts": [ "..." ],
  "scanner_integrations": [ "..." ]
}

The free JSON API returns basic KEV fields only. Confidence, telemetry, and artifact enrichment require Pro API access.

CVE-2020-11023

At a Glance

Affected Versions

CVE References

Recommended Actions

Known Exploited Vulnerability Sources

Virtual Patch

CVSS Scores

Exploitation Status

Weaknesses (CWE)

Scanner Integrations

Potential Proof of Concepts

Timeline

Automate This Intelligence with the Pro API