What is the CVSS score of CVE-2020-11023?

CVE-2020-11023 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 83.8%.

Which versions of Jquery are affected by CVE-2020-11023?

In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation.. A patch is available.

Is there a public PoC exploit available for CVE-2020-11023?

Yes, a public proof-of-concept exploit is available for CVE-2020-11023. Prioritise patching immediately. EPSS: 83.8%.

Is there a patch available for CVE-2020-11023?

Yes, a patch is available for CVE-2020-11023. Update the affected software to the latest version immediately.

Jquery CVE-2020-11023

MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2020-04-29 security-advisories@github.com

XSS Jquery Debian Linux Fedora Drupal Application Express Application Testing Suite Banking Enterprise Collections Banking Platform Blockchain Platform Business Intelligence Communications Analytics Communications Eagle Application Processor Communications Element Manager Communications Interactive Session Recorder Communications Operations Monitor Communications Services Gatekeeper Communications Session Report Manager Communications Session Route Manager Financial Services Regulatory Reporting For De Nederlandsche Bank Financial Services Revenue Management And Billing Analytics Health Sciences Inform Healthcare Translational Research Hyperion Financial Reporting Jd Edwards Enterpriseone Orchestrator Jd Edwards Enterpriseone Tools Oss Support Tools Peoplesoft Enterprise Human Capital Management Resources Primavera Gateway Rest Data Services Siebel Mobile Storagetek Acsls Storagetek Tape Analytics Sw Tool Webcenter Sites Weblogic Server H300s Firmware H500s Firmware H700s Firmware H300E Firmware H500E Firmware H700E Firmware H410s Firmware H410c Firmware Active Iq Unified Manager Cloud Backup Cloud Insights Storage Workload Security Agent Hci Baseboard Management Controller Max Data Oncommand Insight Oncommand System Manager Snap Creator Framework Snapcenter Server Log Correlation Engine

6.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Added to CISA KEV

Jul 14, 2026 - 04:22 CISA

CVE Published

Apr 29, 2020 - 21:15 nvd

MEDIUM 6.1

DescriptionNVD

In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.

AnalysisAI

In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.

Technical ContextAI

This vulnerability is classified as Cross-Site Scripting (XSS) (CWE-79), which allows attackers to inject malicious scripts into web pages viewed by other users. In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0. Affected products include: Jquery, Debian Debian Linux, Fedoraproject Fedora, Drupal, Oracle Application Express. Version information: before 3.5.0.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Sanitize all user input, use Content-Security-Policy headers, encode output contextually (HTML, JS, URL). Use frameworks with built-in XSS protection.