CVE-2020-11022
Publication date 29 April 2020
Last updated 21 July 2025
Ubuntu priority
Description
In jQuery versions greater than or equal to 1.2 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| drupal7 | 25.04 plucky | Not in release |
| 24.04 LTS noble | Not in release | |
| 22.04 LTS jammy | Not in release | |
| 20.04 LTS focal | Not in release | |
| 18.04 LTS bionic | Not in release | |
| 16.04 LTS xenial |
Fixed 7.44-1ubuntu1~16.04.0+esm3
|
|
| 14.04 LTS trusty |
Fixed 7.26-1ubuntu0.1+esm3
|
|
| jquery | 25.04 plucky | Not in release |
| 24.04 LTS noble | Not in release | |
| 22.04 LTS jammy | Not in release | |
| 20.04 LTS focal |
Fixed 3.3.1~dfsg-3ubuntu0.1
|
|
| 18.04 LTS bionic |
Fixed 3.2.1-1ubuntu0.1~esm1
|
|
| 16.04 LTS xenial |
Fixed 1.11.3+dfsg-4ubuntu0.1~esm1
|
|
| 14.04 LTS trusty |
Not affected
|
Get expanded security coverage with Ubuntu Pro
Reduce your average CVE exposure time from 98 days to 1 day with expanded CVE patching, ten-years security maintenance and optional support for the full stack of open-source applications. Free for personal use.
Get Ubuntu Pro 30-day free trialSeverity score breakdown
| Parameter | Value |
|---|---|
| Base score |
6.9 · Medium
|
| Attack vector | Network |
| Attack complexity | High |
| Privileges required | None |
| User interaction | Required |
| Scope | Changed |
| Confidentiality | High |
| Integrity impact | Low |
| Availability impact | None |
| Vector | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N |
References
Related Ubuntu Security Notices (USN)
- USN-7246-1
- jQuery vulnerabilities
- 30 January 2025
- USN-7622-1
- jQuery vulnerabilities
- 8 July 2025
- USN-7658-1
- Drupal vulnerabilities
- 21 July 2025