CVE-2020-11023 in BI Publisher

Summary

In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Responsible

GitHub, Inc.

Status

Confirmed

Entries

VulDB provides additional information and datapoints for this CVE:

ID	Vulnerability	CWE	Exp	Cou	CVE
242738	Oracle BI Publisher Mobile Service cross site scripting	79	Attacked	Official fix	CVE-2020-11023
204406	Oracle Business Intelligence Enterprise Edition Service Administration UI cross site scripting	79	Attacked	Official fix	CVE-2020-11023
190988	Oracle WebLogic Server Sample apps cross site scripting	79	Attacked	Official fix	CVE-2020-11023
184868	Oracle Health Sciences InForm jQuery cross site scripting	79	Attacked	Official fix	CVE-2020-11023
179246	Oracle OSS Support Tools jQuery cross site scripting	79	Attacked	Official fix	CVE-2020-11023
173331	Oracle Database Oracle Application Express cross site scripting	79	Attacked	Official fix	CVE-2020-11023
163002	Oracle REST Data Services jQuery cross site scripting	79	Attacked	Official fix	CVE-2020-11023
162985	Oracle Database Server ORDS cross site scripting	79	Attacked	Official fix	CVE-2020-11023
162984	Oracle Database Server Application Express cross site scripting	79	Attacked	Official fix	CVE-2020-11023
154588	jQuery html cross site scripting	79	Attacked	Official fix	CVE-2020-11023

Sources

• MITRE
• NVD
• CVE Details