CVE-2020-11023
MediumExploitedPublic exploitPotential XSS vulnerability in jQuery
Published Apr 29, 2020 · Updated Sep 10, 2026 · Also known as 21a27a8b-f599-42b9-9439-4456995dd3fe, BIT-drupal-2020-11023, DEBIAN-CVE-2020-11023, GHSA-jpcq-cgw6-v4j6, TR-21-0882, UBUNTU-CVE-2020-11023
Key Facts
Patch immediately- CVE-2020-11023 is a medium-severity vulnerability (CVSS 6.1 v3.1) affecting Drupal, jQuery, Active Iq Unified Manager (Netapp) and 22 more products.
- It is exploited in the wild, listed in CISA KEV, Industry KEV feed, CIRCL KEV, ENISA EUVD since Jan 21, 2021. Public exploit code is available.
- EPSS estimates a 85% probability of exploitation in the next 30 days.
- Fixed versions are available, including ansible-tower 36/ansible-tower:3.6.7-1, apache-commons-collections 3.2.2-10.module+el8.3.0+53+ea062990, apache-commons-collections 3.2.2-10.module+el8.3.0+7697+44932688.
- Brandefense priority: patch immediately, because it is listed as exploited in the wild.
CVSS v3.1
6.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS (30-day exploit likelihood)
85%
Higher than 99.7% of all scored CVEs
Exploited in the wild
Yes
4 catalog listings
Public exploit code
Available
Proof-of-concept or weaponized module
Get the full CVE-2020-11023 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.
Known-Exploited Catalog Listings
| Catalog | Added | Remediation due | Ransomware use |
|---|---|---|---|
| CISA KEV | Jan 23, 2025 | Feb 13, 2025 | Not reported |
| Industry KEV feed | Jan 21, 2021 | Feb 13, 2025 | Not reported |
| CIRCL KEV | Jan 23, 2025 | Feb 13, 2025 | Not reported |
| ENISA EUVD | Jan 23, 2025 | n/a | Not reported |
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Affected Products
612 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| DrupalDrupal | >= 7.0.0 | 7.70 |
| jQueryJquery | >= 1.0.3, >= >= 1.0.3, < 3.5.0 | 3.5.0 |
| Active Iq Unified ManagerNetapp | See advisory | n/a |
| Cloud BackupNetapp | See advisory | n/a |
| Cloud Insights Storage Workload Security AgentNetapp | See advisory | n/a |
Patched Releases
ansible-tower
36/ansible-tower:3.6.7-1
apache-commons-collections
3.2.2-10.module+el8.3.0+53+ea062990, 3.2.2-10.module+el8.3.0+7697+44932688
apache-commons-lang
2.6-21.module+el8.3.0+53+ea062990, 2.6-21.module+el8.3.0+7697+44932688
apache-commons-net
3.6-3.module+el8.3.0+53+ea062990, 3.6-3.module+el8.3.0+7697+44932688
bea-stax
1.2.0-16.module+el8.3.0+53+ea062990
bea-stax-api
1.2.0-16.module+el8.3.0+7697+44932688
bind-dyndb-ldap
11.6-2.module_el8.5.0+2603+92118e57, 11.6-2.module+el8.4.0+20088+3d202164, 11.6-2.module+el8.4.0+429+6bd33fea
bootstrap
3.0.0-7.0.1.el7
cacti
1.2.13-11.1, 1.2.13-bp151.4.12.1, 1.2.13-r0
cacti-spine
1.2.13-8.1, 1.2.13-bp151.4.12.1
components/jquery
3.5.0
cpp
11.5.0-5.0.1.el9_5, 4.8.5-45.0.1.el7_9, 8.5.0-23.0.1.el8_10
custodia
0.6.0-3.module_el8.6.0+2881+2f24dc92, 0.6.0-3.module+el8.3.0+7868+2151076c, 0.6.0-3.module+el8.4.0+429+6bd33fea
discovery/discovery-server-rhel9:1.12.0
1
discovery/discovery-ui-rhel9:1.12.0
1
doxygen
1:1.8.14-13.el8_10, 1:1.8.5-3.el7_7.1, 1:1.8.5-4.0.1.el7, 1:1.9.1-12.el9_4, 1:1.9.1-12.el9_5
doxygen-doxywizard
1:1.8.5-4.0.1.el7, 1:1.9.1-12.el9_5
doxygen-latex
1:1.8.5-4.0.1.el7, 1:1.9.1-12.el9_5
Drupal
7.70.0, 8.7.14, 8.8.6, 7.70
drupal7
7.26-1ubuntu0.1+esm3, 7.44-1ubuntu1~16.04.0+esm3, 7.52-2+deb9u10, 7.70-r0
eap7-hal-console
0:3.3.16-1.Final_redhat_00001.1.el7eap, 0:3.3.16-1.Final_redhat_00001.1.el8eap, 0:3.3.16-1.Final_redhat_00001.1.el9eap
gcc
0:11.5.0-5.el9_5, 0:4.8.5-45.el7_9, 0:8.5.0-10.4.el8_6, 11.5.0-2.el9+sp999, 11.5.0-5.0.1.el9_5, 11.5.0-5.el9_5, 11.5.0-5.el9_5.alma.1, 4.8.5-45.0.1.el7_9, 8.5.0-23.0.1.el8_10, 8.5.0-23.el8_10, 8.5.0-23.el8_10.alma.1
gcc-c++
11.5.0-5.0.1.el9_5, 4.8.5-45.0.1.el7_9, 8.5.0-23.0.1.el8_10
gcc-gdb-plugin
8.5.0-23.0.1.el8_10
gcc-gfortran
11.5.0-5.0.1.el9_5, 4.8.5-45.0.1.el7_9, 8.5.0-23.0.1.el8_10
Timeline
Publicly disclosed
Apr 29, 2020
Added to Industry KEV feed
Jan 21, 2021
Added to CISA KEV
Jan 23, 2025
Added to CIRCL KEV
Jan 23, 2025
Added to ENISA EUVD
Jan 23, 2025
Last updated
Sep 10, 2026
Weakness Type
- CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
- CWE-1395 Dependency on Vulnerable Third-Party Component
References
- advisoryhttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-6708
- advisoryhttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5237
- advisoryhttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-9251
- advisoryhttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17195
- advisoryhttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11022
FAQ
Common Questions.
In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e.
Affected: Drupal versions >= 7.0.0; jQuery versions >= 1.0.3, >= >= 1.0.3, < 3.5.0; Active Iq Unified Manager (Netapp), among others. The full list is in the CVE brief.
It is exploited in the wild, listed in CISA KEV, Industry KEV feed, CIRCL KEV, ENISA EUVD since Jan 21, 2021.
Yes. It was added on Jan 23, 2025 with a federal remediation due date of Feb 13, 2025.
Public exploit code is available.
Fixed versions are available, including ansible-tower 36/ansible-tower:3.6.7-1, apache-commons-collections 3.2.2-10.module+el8.3.0+53+ea062990, apache-commons-collections 3.2.2-10.module+el8.3.0+7697+44932688.
Brandefense priority: patch immediately, because it is listed as exploited in the wild.
Is CVE-2020-11023 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo