CVE-2020-11023

medium KEV

Published 2020-04-29 · Modified 2025-02-14

💬 Discuss on Community ✚ Propose mitigation

CVSS v3

—

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N/E:H

CVSS v4 NEW

—

not yet in upstream

VIR risk

8.0

Description

Moderate: gcc security update

CISA KEV

Vendor: JQuery
Product: JQuery
Due date: 2025-02-13

Predictions

Exploit likelihood

99%

Patch ETA

—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

vendor Authored 2026-05-27

{Vendor advisory: cisa-kev — This vulnerability could affect an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https://github.com/jquery/jquery/security/advisories/GHSA-jpcq-cgw6-v4j6 ; https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/ ; https://nvd.nist.gov/vuln/detail/CVE-2020-11023}

Exploits

Public proof-of-concept code below. AS-IS, for defenders and authorised testing only.

Exploit-DB

EDB-49767 webapps multiple

Central InfoSec · 2021-04-14

jQuery 1.0.3 - Cross-Site Scripting (XSS)

Source code queued for fetch — refresh in a moment.

OS impact

SUSE Affected 1 release

Version	Status	Fixed in
—	Affected	—

AlmaLinux Fixed 2 releases

Version	Status	Fixed in
9	Fixed	`tbb-devel-2020.3-8.el9_5.1.aarch64.rpm`
8	Fixed	`libgcc-8.5.0-23.el8_10.alma.1.i686.rpm`

Debian Fixed 5 releases

Version	Status	Fixed in
trixie	Fixed	`3.5.0+dfsg-2`
sid	Fixed	`3.5.0+dfsg-2`
forky	Fixed	`3.5.0+dfsg-2`
bullseye	Fixed	`3.5.0+dfsg-2`
bookworm	Fixed	`3.5.0+dfsg-2`

Red Hat Fixed 2 releases

Version	Status	Fixed in
9	Fixed	—
8	Fixed	—

Rocky Linux Fixed 2 releases

Version	Status	Fixed in
9	Fixed	—
8	Fixed	—

Package impact

Ecosystem	Package	Vulnerable	Fixed
RubyGems	jquery-rails	`<>= 4.4.0`	`>= 4.4.0`
npm	jquery	`>=1.0.3,<3.5.0`	`3.5.0`
RubyGems	jquery-rails	`<4.4.0`	`4.4.0`
NuGet	jQuery	`>=1.0.3,<3.5.0`	`3.5.0`
Maven	org.webjars.npm:jquery	`>=1.0.3,<3.5.0`	`3.5.0`
Packagist	components/jquery	`>=1.0.3,<3.5.0`	`3.5.0`

References

Community-verified mitigations for this CVE will appear above when contributors publish them.

Verify integrity in audit chain (admin only). AS-IS.