PT-2020-6938
CVE-2020-23064
·
تاريخ النشر
2020-04-10
·
تاريخ التحديث
2025-09-29
الوصف من
CVSS 2.0
6.4
متوسطةالمقاييسAV:N/AC:L/Au:N/C:P/I:P/A:N
Name of the Vulnerable Software and Affected Versions
jQuery versions 2.2.0 through 3.5.0
Description
The issue is related to Cross Site Scripting vulnerability, which allows a remote attacker to execute arbitrary code via the
<option> element. Passing HTML containing <option> elements from untrusted sources to one of jQuery's DOM manipulation methods, such as .html() or .append(), may execute untrusted code.Recommendations
To resolve the issue, update to jQuery 3.5.0 or later.
As a temporary workaround, use DOMPurify with its
SAFE FOR JQUERY option to sanitize the HTML string before passing it to a jQuery method. وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾