SECURELYN
Free ScanFree consultation

jQuery (CVE-2020-11022)

CVE-2020-11022 is a published vulnerability record for jQuery. This draft does not describe the flaw yet. A Securelyn engineer adds the verified description, affected versions and fixed release from the vendor and NVD pages before the advisory goes live.

Check if you are exposedTalk to an expert

Automated summary, not yet reviewed by a Securelyn engineer

Who should care

Anyone who runs jQuery on a website, server or network they are responsible for, and anyone who pays a provider to run it for them. Our exposure check can recognise jQuery from public signals on a website, so you can use it to find out.

What to do

  1. Find out whether you run jQuery, and which version. Ask your web developer or hosting provider if you are not sure.
  2. Read the vendor's advisory for CVE-2020-11022 and note the fixed release. The NVD record under References links to the vendor's page.
  3. Update to the fixed release or a later one. If you cannot update now, ask your provider which workarounds the vendor documents.
  4. Check the CISA catalogue under References to see whether CVE-2020-11022 is listed as exploited. If it is, treat the update as urgent.
  5. Run the exposure check on this page again once you have updated.

What is affected

Affected versions are not recorded in our offline sample. Read the vendor's advisory for CVE-2020-11022 to see which jQuery versions are affected and which release fixes them.

Is it being exploited?

CISA KEV
Not in our offline sample: check the CISA catalogue.
EPSS
Not in our offline sample: check the CISA catalogue.

Severity and technical details

Fixed in
  • 3.5.0
  • 4.4.0
  • 1.19.0
  • 4.0.1
Also known as
  • GHSA-gxr4-xjj5-5px2
Fixed versions and aliases from
OSV.dev open-source vulnerability database

References