CVE-2020-7656
Fixed in a distro release EPSS 6%
jquery prior to 1.9.0 allows Cross-site Scripting attacks via the load method. The load method fails to recognize and remove "<script>" HTML tags that contain a whitespace character, i.e: "</script >", which results in the enclosed script logic to be executed.
Products: jquery, oracle peoplesoft_enterprise_peopletools, netapp active_iq_unified_manager, netapp cloud_backup, netapp oncommand_system_manager, netapp snap_creator_framework, juniper junos
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | org.webjars.npm:jquery | 1.9.0 |
| NuGet | jQuery | 1.9.0 |
| RubyGems | jquery-rails | 2.2.0 |
| npm | jquery | 1.9.0 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux 8 | pcs | 0.10.10-4.el8.alma |
| AlmaLinux 8 | pcs-snmp | 0.10.10-4.el8.alma |
| Red Hat amq interconnect 1 | qpid-dispatch | 0:1.13.0-3.el7 |
| Red Hat amq interconnect 1 | qpid-dispatch | 0:1.13.0-3.el6_10 |
| Red Hat amq interconnect 1 | qpid-dispatch | 0:1.13.0-3.el8 |
| Red Hat amq interconnect 1 | qpid-dispatch-console | 0:1.13.0-3.el7 |
| Red Hat amq interconnect 1 | qpid-dispatch-console | 0:1.13.0-3.el6_10 |
| Red Hat amq interconnect 1 | qpid-dispatch-console | 0:1.13.0-3.el8 |
| Red Hat amq interconnect 1 | qpid-dispatch-debuginfo | 0:1.13.0-3.el6_10 |
| Red Hat amq interconnect 1 | qpid-dispatch-debuginfo | 0:1.13.0-3.el7 |
| Red Hat amq interconnect 1 | qpid-dispatch-debugsource | 0:1.13.0-3.el8 |
| Red Hat amq interconnect 1 | qpid-dispatch-docs | 0:1.13.0-3.el8 |
| Red Hat amq interconnect 1 | qpid-dispatch-docs | 0:1.13.0-3.el6_10 |
| Red Hat amq interconnect 1 | qpid-dispatch-docs | 0:1.13.0-3.el7 |
| Red Hat amq interconnect 1 | qpid-dispatch-router | 0:1.13.0-3.el7 |
| Red Hat amq interconnect 1 | qpid-dispatch-router | 0:1.13.0-3.el6_10 |
| Red Hat amq interconnect 1 | qpid-dispatch-router | 0:1.13.0-3.el8 |
| Red Hat amq interconnect 1 | qpid-dispatch-router-debuginfo | 0:1.13.0-3.el8 |
| Red Hat amq interconnect 1 | qpid-dispatch-tools | 0:1.13.0-3.el7 |
| Red Hat amq interconnect 1 | qpid-dispatch-tools | 0:1.13.0-3.el6_10 |
| Red Hat amq interconnect 1 | qpid-dispatch-tools | 0:1.13.0-3.el8 |
| Red Hat Enterprise Linux 8 | pcs | 0:0.10.10-4.el8 |
| Red Hat Enterprise Linux 8 | pcs-snmp | 0:0.10.10-4.el8 |
| Rocky Linux 8 | pcs | 0:0.10.10-4.el8 |
| Ubuntu Pro 14.04 LTS | jquery | no fix |
| Ubuntu Pro 16.04 LTS | jquery | no fix |