Lucene search
GitHub Advisory DatabaseGHSA-V73W-R9XG-7CR9HistoryJun 05, 2020 - 7:37 p.m.
Use of insecure jQuery version in OctoberCMS
2020-06-0519:37:49
GitHub Advisory Database
github.com
200
Impact
Passing HTML from untrusted sources - even after sanitizing it - to one of jQuery’s DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code.
Patches
Issue has been patched in Build 466 (v1.0.466) by applying the recommended patch from @jquery.
Workarounds
Apply https://github.com/octobercms/october/commit/5c7ba9fbe9f2b596b2f0e3436ee06b91b97e5892 to your installation manually if unable to upgrade to Build 466.
References
- https://github.com/jquery/jquery/security/advisories/GHSA-gxr4-xjj5-5px2
- https://vulners.com/cve/CVE-2020-11022
- https://jquery.com/upgrade-guide/3.5/
For more information
If you have any questions or comments about this advisory:
- Email us at [email protected] & [email protected]
Threat Assessment
Assessed as Moderate by the @jquery team.
Acknowledgements
Thanks to @mrgswift for reporting the issue to the October CMS team.
| CPE | Name | Operator | Version |
|---|---|---|---|
| october/system | lt | 1.0.466 | |
| october/october | lt | 1.0.466 |
Related
openvas
openvas
jQuery 1.2 < 3.5.0 XSS Vulnerability
2020-05-05 00:00:00
Fedora: Security Advisory for drupal7 (FEDORA-2020-11be4b36d4)
2020-06-07 00:00:00
Debian: Security Advisory for drupal7 (DSA-4693-1)
2020-05-28 00:00:00
cve
cve
CVE-2020-11022
2020-04-29 22:15:00
nodejs
nodejs
Cross-Site Scripting
2020-04-30 18:19:09
nessus
nessus
F5 Networks BIG-IP : jQuery vulnerability (K02453220)
2023-11-02 00:00:00
Oracle JDeveloper XSS (October 2020 CPU)
2020-11-02 00:00:00
RHEL 7 : OpenShift Container Platform 3.11 (RHSA-2020:2217)
2020-06-01 00:00:00
veracode
veracode
Cross-Site Scripting (XSS)
2020-04-30 01:59:55
packetstorm
packetstorm
jQuery 1.2 Cross Site Scripting
2021-04-14 00:00:00
githubexploit
githubexploit
Exploit for Cross-site Scripting in Jquery
2020-11-02 20:55:10
Exploit for Cross-site Scripting in Jquery
2021-10-16 01:10:33
Exploit for Cross-site Scripting in Jquery
2020-04-14 19:12:01
osv
osv
CVE-2020-11022
2020-04-29 22:15:11
Use of insecure jQuery version in OctoberCMS
2020-06-05 19:37:49
BIT-drupal-2020-11022
2024-03-06 10:59:15
f5
f5
K02453220 : jQuery vulnerability CVE-2020-11022
2020-08-03 00:00:00
zdt
zdt
jQuery 1.2 - Cross-Site Scripting Vulnerability
2021-04-14 00:00:00
ubuntucve
ubuntucve
CVE-2020-11022
2020-04-29 00:00:00
debiancve
debiancve
CVE-2020-11022
2020-04-29 22:15:00
prion
prion
Code injection
2020-04-29 22:15:00
redhat
redhat
redhatcve
redhatcve
CVE-2020-11022
2020-04-29 23:09:52
hackerone
hackerone
Reddit: CVE-2020-11022
2022-12-20 17:19:58
github
github
Potential XSS vulnerability in jQuery
2020-04-29 22:18:55
Persistent Cross-site Scripting vulnerability in PrivateBin
2022-04-12 20:45:22
alpinelinux
alpinelinux
CVE-2020-11022
2020-04-29 22:15:00
ibm
ibm
Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to cross-site scripting in jQuery (CVE-2020-11022).
2023-01-12 21:59:00
exploitdb
exploitdb
jQuery 1.2 - Cross-Site Scripting (XSS)
2021-04-14 00:00:00
atlassian
atlassian
Update jQuery to avoid CVE-2020-11022 and CVE-2020-11023
2021-02-02 09:59:24
Update jQuery to avoid CVE-2020-11022 and CVE-2020-11023
2021-02-02 09:59:24
jquery 2.2.4 XSS vulnerability
2022-08-24 14:53:45
fedora
fedora
[SECURITY] Fedora 32 Update: drupal8-8.9.0-1.fc32
2020-06-16 01:32:24
[SECURITY] Fedora 32 Update: drupal7-7.70-1.fc32
2020-05-31 03:31:15
[SECURITY] Fedora 33 Update: drupal7-7.72-1.fc33
2020-09-25 17:15:48
attackerkb
attackerkb
CVE-2020-11023
2020-04-29 00:00:00
CVE-2020-11022
2020-04-29 00:00:00
hp
hp
joomla
joomla
[20200604] - Core - XSS in jQuery.htmlPrefilter
2020-04-10 00:00:00
suse
suse
Security update for otrs (moderate)
2020-11-10 00:00:00
Security update for cacti, cacti-spine (moderate)
2020-07-25 00:00:00
Security update for cacti, cacti-spine (moderate)
2020-07-28 00:00:00
debian
debian
[SECURITY] [DLA 2608-1] jquery security update
2021-03-26 01:32:22
[SECURITY] [DSA 4693-1] drupal7 security update
2020-05-26 21:08:21
oraclelinux
oraclelinux
jquery-ui security update
2022-03-01 00:00:00
ipa security, bug fix, and enhancement update
2020-10-06 00:00:00
idm:DL1 and idm:client security, bug fix, and enhancement update
2020-11-10 00:00:00
checkpoint_advisories
checkpoint_advisories
jQuery Cross Site Scripting (CVE-2020-11022; CVE-2020-11023)
2020-11-16 00:00:00
drupal
drupal
Drupal core - Moderately critical - Cross Site Scripting - SA-CORE-2020-002
2020-05-20 00:00:00
ics
ics
AVEVA InTouch Access Anywhere and Plant SCADA Access Anywhere (Update A)
2023-03-16 12:00:00
Mitsubishi Electric EcoWebServerIII
2022-02-24 12:00:00
typo3
typo3
Cross-Site Scripting in extension "Kitodo.Presentation" (dlf)
2020-07-29 00:00:00
gentoo
gentoo
Cacti: Multiple vulnerabilities
2020-07-26 00:00:00
altlinux
altlinux
Security fix for the ALT Linux 9 package phpipam version 1.42.027-alt1
2020-10-21 00:00:00
freebsd
freebsd
Cacti -- multiple vulnerabilities
2020-07-15 00:00:00
adobe
adobe
APSB19-38 Security update available for Adobe Experience Manager
2019-07-09 00:00:00
rocky
rocky
idm:DL1 and idm:client security, bug fix, and enhancement update
2020-11-03 12:25:36
centos
centos
ipa, python2 security update
2020-10-20 18:15:27
almalinux
almalinux
amazon
amazon
Medium: ipa
2020-10-22 17:40:00
Related for GHSA-V73W-R9XG-7CR9