6.9

CVE-2020-11022: jQuery has a potential XSS vulnerability

Modified
AliasesSUSE-SU-2020:2292-1SUSE-SU-2020:2373-1RHSA-2020:2217
Published 29-04-2020Last modified 02-11-2026

Vulnerability summary

CVE-2020-11022 is a medium (CVSS 6.9) vulnerability in debian debian_linux. EPSS estimates a 99.22% chance of exploitation in the next 30 days, higher than 99.9% of scored vulnerabilities. 2 public exploits are recorded.

Priority
Routine

Not severe (CVSS 6.9, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?
CVSS score
6.9/10
010
Medium · v3.1 (CVE.org)
EPSS score
99.22%
0%100%
Critical · 0.00 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits2reference, exploit-database

Advisory lineage

Upstream 0 · Downstream 26 · Related 10
DLA-2608-1DLA-3551-1DSA-4693-1OPENSUSE-SU-2020:1060-1OPENSUSE-SU-2020:1106-1OPENSUSE-SU-2020:1888-1

Timeline

  1. 29-04-2020
    PublishedVulnerability first disclosed.
  2. 02-11-2026
    Last modifiedVulnerability information updated.

Description

In jQuery starting with 1.12.0 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.

CVSS metrics

13 scores · 12 sources · 2 versions

EPSS trend

Probability

99.22%

Chance of exploitation in the next 30 days

Percentile

100%

Versus all other CVEs

30-day change

No change 0.00 pp

From 99.22% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

2 found
  • referenceUnverified

    Exploit Reference (packetstormsecurity.com)

    Maturity: unknown

  • exploit-databasemultipleUnverified

    jQuery 1.2 - Cross-Site Scripting (XSS)

    Maturity: poc

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: network-reachable, no authentication, user interaction (CVSS vector). Other conditions: not stated in public data.

Suse63 products
  • bind-formula&distro=SUSE Manager Server 3.2< 0.1.1584363976.36bce64-3.6.1
  • branch-network-formula&distro=SUSE Manager Server 3.2< 0.1.1584363976.36bce64-3.9.1
  • cobbler&distro=SUSE Manager Server Module 4.1< 3.0.0+git20190806.32c4bae0-5.3.6
  • golang-github-QubitProducts-exporter_exporter&distro=SUSE Manager Proxy Module 4.1< 0.4.0-6.3.6
  • golang-github-QubitProducts-exporter_exporter&distro=SUSE Manager Server Module 4.1< 0.4.0-6.3.6
Oracle50 products
Netapp13 products
Debian3 products
  • node-jquery< 3.5.0+dfsg-2
  • zncAll versions (No fix recorded) | < 1.10.3-1
  • debian_linuxEOL9.0
Alpine2 products
  • cacti< 1.2.13-r0
  • drupal7< 7.70-r0
Chainguard2 products
  • keycloak-26.6All versions (No fix recorded)
  • keycloak-26.6-iamguarded-compat< 26.6.6-r0
Opensuse2 products
  • leapEOL15.1 | 15.2
  • syncthing&distro=openSUSE Tumbleweed< 2.1.0-1.1
Ubuntu2 products
  • drupal7< 7.26-1ubuntu0.1+esm3 | < 7.44-1ubuntu1~16.04.0+esm3
  • jquery< 1.11.3+dfsg-4ubuntu0.1~esm1 | < 3.2.1-1ubuntu0.1~esm1 | < 3.3.1~dfsg-3ubuntu0.1
Wolfi2 products
  • keycloak-26.6All versions (No fix recorded)
  • keycloak-26.6-iamguarded-compat< 26.6.6-r0
Athlon16001 product
  • youtube-downloader< 4.0.1
Components1 product
  • jquery≥ 1.12.0, < 3.5.0
Drupal1 product
  • drupal≥ 7.0, < 7.70 | ≥ 8.7.0, < 8.7.14 | ≥ 8.8.0, < 8.8.6
Fedoraproject1 product
Jquery1 product
  • jquery≥ 1.12.0, < 3.5.0 | ≥ 1.2, < 3.5.0
Maximebf1 product
  • debugbar< 1.19.0
Npm1 product
  • jquery≥ 1.12.0, < 3.5.0
NuGet1 product
  • jquery≥ 1.12.0, < 3.5.0
Org.webjars.npm1 product
  • jquery≥ 1.12.0, < 3.5.0
Redhat1 product
  • atomic-openshift-web-console< 0:3.11.219-1.git.1.9b9b889.el7
RubyGems1 product
  • jquery-rails< 4.4.0
Tenable1 product

21 vendors · 151 products

References

143 links
Show all 100 references

Showing 100 of 143.