Dashboard / CVE-2020-11022

CVE-2020-11022

MEDIUM 3 PoCs
ACT NOW Priority: 6.05 BB Relevance: 82/100
Published: 2020-04-29 Modified: 2026-11-02 First seen: 2026-11-02 Status: active

Attack Surface

Network Low Complexity No Auth Scope Change

CVSS Vector Breakdown

AV: Network
AC: Low
PR: None
UI: Required
S: Changed
C: Low
I: Low
A: None

Description

In jQuery starting with 1.12.0 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.

Weakness Classification (1)

Affected Software (119)

VendorProductVersion
debian debian_linux 9.0
drupal drupal 7.0 – 7.70
fedoraproject fedora 31
fedoraproject fedora 32
fedoraproject fedora 33
jquery jQuery >= 1.12.0, < 3.5.0
jquery jquery 1.2 – 3.5.0
netapp h300e_firmware -
netapp h300s_firmware -
netapp h410c_firmware -
netapp h410s_firmware -
netapp h500e_firmware -
netapp h500s_firmware -
netapp h700e_firmware -
netapp h700s_firmware -
netapp max_data -
netapp oncommand_insight -
netapp oncommand_system_manager 3.0 – 3.1.3
netapp snap_creator_framework -
netapp snapcenter -
opensuse leap 15.1
opensuse leap 15.2
oracle agile_product_lifecycle_management_for_process 6.2.0.0
oracle agile_product_supplier_collaboration_for_process 6.2.0.0
oracle application_testing_suite 13.3.0.1
oracle banking_digital_experience 18.1
oracle banking_digital_experience 18.2
oracle banking_digital_experience 18.3
oracle banking_digital_experience 19.1
oracle banking_digital_experience 19.2
Showing 30 of 119 entries

References & Advisories (71)

Showing 25 of 71 references

Proof of Concept (3)

★ 34
https://github.com/0xAJ2K/CVE-2020-11022-CVE-2020-11023
nomi-sec
★ 1
https://github.com/Snorlyd/https-nj.gov---CVE-2020-11022
nomi-sec
—
https://github.com/okni2k/HW-Pyton-10
nomi-sec

Bug Bounty Relevance

82 / 100
✓ Network accessible
✓ No authentication
✓ Low complexity
✓ PoC available (3)
✓ High exploitation probability

CVSS Score

6.1 / 10.0 v3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS — Exploitation Probability

99.22%
Raw Score 0.992150
Percentile 99.9%
Date 2026-11-04

EPSS Trend

2026-11-04
0.99215
2026-11-03
0.99215
2026-11-02
0.99215

Intelligence Sources

mitre ref →
nvd ref →

External Links