CVE-2020-11023 is a medium-severity vulnerability affecting jQuery versions greater than or equal to 1.0.3 and before 3.5.0. It allows untrusted code execution when passing HTML containing <option> elements from untrusted sources to jQuery's DOM manipulation methods. This vulnerability impacts a variety of systems, including jQuery, Debian Linux, Fedora, Drupal, Oracle products, and others. To mitigate this issue, it is recommended to update to jQuery 3.5.0 or apply the necessary security updates for the affected systems.

How do I know if I'm affected?

To determine if you're affected by the vulnerability, check if you're using jQuery versions greater than or equal to 1.0.3 and before 3.5.0. This vulnerability may impact systems like Debian Linux, Fedora, Drupal, Oracle products, and others. It allows untrusted code execution when passing HTML containing <option> elements from untrusted sources to jQuery's DOM manipulation methods. If you're using an affected version of jQuery, it's possible that your system is vulnerable to this issue.

What should I do if I'm affected?

If you're affected by the vulnerability, it's important to take action to secure your system. Update your jQuery to version 3.5.0 or apply security updates for affected systems like Debian Linux, Fedora, Drupal, and Oracle products. For Drupal users, upgrade to the latest versions (8.8.6 for Drupal 8.8, 8.7.14 for Drupal 8.7, and 7.70 for Drupal 7) to install the necessary fixes.

Is this in CISA’s Known Exploited Vulnerabilities Catalog?

Yes, CVE-2020-11023 is in CISA's Known Exploited Vulnerabilities Catalog. The vulnerability, named cross-site scripting (XSS) vulnerability, was added on April 29, 2020. This affects jQuery versions greater than or equal to 1.0.3 and before 3.5.0. To address this vulnerability, it is necessary to update to jQuery version 3.5.0 or later.

Weakness enumeration

The weakness enumeration for this vulnerability is categorized as CWE-79, is related to cross-site scripting (XSS) in jQuery versions 1.0.3 to 3.4.1. To fix this issue, update to jQuery 3.5.0 or later, which addresses the problem.

For more details

CVE-2020-11023 is a medium-severity vulnerability affecting various systems, including jQuery, Debian Linux, Fedora, Drupal, and Oracle products. By updating to jQuery 3.5.0 or applying necessary security updates, users can mitigate this issue. For a comprehensive understanding of the vulnerability, including its description, severity, technical details, and known affected software configurations, visit the NVD page or the links below.

• openSUSE Security Update for Cacti and Cacti-Spine

• jQuery Core 3.5 Upgrade Guide

• Debian LTS Security Update for OTRS2

• Drupal Core Security Advisory - Cross Site Scripting