Your submission was sent successfully! Close

You have successfully unsubscribed! Close

Thank you for signing up for our newsletter!
In these regular emails you will find the latest updates about Ubuntu and upcoming events where you can meet our team.Close

CVE-2020-7656

Published: 19 May 2020

jquery prior to 1.9.0 allows Cross-site Scripting attacks via the load method. The load method fails to recognize and remove "<script>" HTML tags that contain a whitespace character, i.e: "</script >", which results in the enclosed script logic to be executed.

Notes

AuthorNote
mdeslaur
This is likely an intrusive, backwards-incompatible change that
may break existing software. We will not be fixing this issue
in stable Ubuntu releases.

Priority

Low

Cvss 3 Severity Score

6.1

Score breakdown

Status

Package Release Status
jquery
Launchpad, Ubuntu, Debian
bionic Not vulnerable
(3.2.1-1)
eoan Ignored
(end of life)
focal Not vulnerable
(3.3.1~dfsg-3)
upstream
Released (1.9.0)
xenial Ignored

trusty Ignored

Patches:
upstream: https://github.com/jquery/jquery/commit/a938d7b1282fc0e5c52502c225ae8f0cef219f0a

Severity score breakdown

Parameter Value
Base score 6.1
Attack vector Network
Attack complexity Low
Privileges required None
User interaction Required
Scope Changed
Confidentiality Low
Integrity impact Low
Availability impact None
Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N