CVE-2020-11023

mediumPriorität · handeln · 90OT-Risiko · kritischKEV · ausgenutztEPSS 0.849 · 100. PerzentilExploit · PoCDEEUFRNLRUUS
grimoire priorityP0 · Act now
Exploitable?
Yes · in the wild
CISA KEV · 7 exploits · PoC
Likely / severe?
84.9% (100th) EPSS
CVSS 4.3 · medium
Is it mine?
226 products
Prüfe deine Angriffsfläche
Who says so?
10 sources
cnnvd · enisa_euvd · fstec_bdu · osv

hinzugefügt 2025-01-23beheben bis 2025-02-13

erforderliche Maßnahme Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

EPSS · bewertet 2026-10-27

JQuery Cross-Site Scripting (XSS) Vulnerability

In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.

01

Behebungen

Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.

Ein Hersteller-Fix ist verfügbar.

  • BehobenVideoEdgecisa_csaf_ot

    Upgrade VideoEdge: to Version 5.7.1

  • BehobenSchneider Electric System Monitor application installed on Schneider Electric Harmony Industrial PC All Versionscisa_csaf_ot

    Customer can uninstall System Monitor application using installer available for download here: https://www.se.com/ww/en/product-range/61054- harmony-industrial-pc/#software-and-firmware Please follow the steps described in the guideline attached as a .pdf in the downloaded uninstaller guide.

    https://www.se.com/ww/en/product-range/61054-harmony-industrial-pc/#software-and-firmware
  • BehobenSchneider Electric System Monitor application installed on Schneider Electric Pro-face Industrial PC All Versionscisa_csaf_ot

    Customer can uninstall System Monitor application using installer available for download here: https://www.proface.com/en/product/ipc/ps5000/download Please follow the steps described in the guideline attached as a .pdf in the downloaded uninstaller guide.

    https://www.proface.com/en/product/ipc/ps5000/download
  • MitigationFesto Automation Suite <2.8.0.138 installed with CODESYS Development System 3.0festo_psirt

    Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.

  • MitigationFesto Automation Suite <2.8.0.138 installed with CODESYS Development System 3.5.16.10festo_psirt

    Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.

  • Mitigationpepperl_fuchs_psirt

    An external protective measure is required. - Minimize network exposure for affected products and ensure that they are not accessible via the Internet. - Isolate affected products from the corporate network. - If remote access is required, use secure methods such as virtual private networks (VPNs).

  • MitigationVideoEdgecisa_csaf_ot

    For more detailed mitigation and product upgrade instructions, please see Johnson Controls Product Security Advisory JCI-PSA-2021-17 v1

    https://www.johnsoncontrols.com/-/media/jci/cyber-solutions/product-security-advisories/2021/jci-psa-2021-17.pdf
  • MitigationWHA-GW-F2D2-0-AS- Z2-ETHcisa_csaf_ot

    If remote access is required, use secure methods such as virtual private networks (VPNs).

  • MitigationWHA-GW-F2D2-0-AS- Z2-ETH.EIPcisa_csaf_ot

    If remote access is required, use secure methods such as virtual private networks (VPNs).

  • MitigationSchneider Electric System Monitor application installed on Schneider Electric Harmony Industrial PC All Versionscisa_csaf_ot

    If customers choose not to apply the remediation provided above, they should immediately apply the following mitigations to reduce the risk of exploit: • Stop the system monitor if not required by turning off the services as specified in user guide: o Harmony Industrial PC Series User Manual • Setup network segmentation and implement a firewall to block all unauthorized access to configured HTTP/HTTPS ports.

    https://www.se.com/ww/en/download/document/EIO0000002042/
  • MitigationSchneider Electric System Monitor application installed on Schneider Electric Pro-face Industrial PC All Versionscisa_csaf_ot

    If customers choose not to apply the remediation provided above, they should immediately apply the following mitigations to reduce the risk of exploit: • Stop the system monitor if not required by turning off the services as specified in user guide: o Pro-face PS5000 legacy industrial PC Series User Manual • Setup network segmentation and implement a firewall to block all unauthorized access to configured HTTP/HTTPS ports.

    https://www.proface.com/en/node/39458
  • MitigationFesto Automation Suite <2.8.0.138 installed with CODESYS Development System 3.0cisa_csaf_ot

    Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.

  • MitigationFesto Automation Suite <2.8.0.138 installed with CODESYS Development System 3.5.16.10cisa_csaf_ot

    Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.

02

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

6.9
010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen

v2.04.3mediumAV:N/AC:M/Au:N/C:N/I:P/A:Nprimary · NVD / NIST USAusnutzbarkeit 8.6 · Auswirkung 2.9
v3.16.1mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:Nprimary · NVD / NIST USAusnutzbarkeit 2.8 · Auswirkung 2.7
v3.06.1mediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:Nsecondary · CISA US
v3.16.9mediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:Nsecondary · ENISA EU
v3.16.9mediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:Nsecondary · security-advisories@github.comAusnutzbarkeit 1.6 · Auswirkung 4.7
v3.16.9mediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N/E:Hsecondary · OSV
v3.16.1mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:Nsecondary · Pepperl+Fuchs PSIRT DE
v3.16.9mediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:Nsecondary · Festo PSIRT DE
v3.16.1mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:Hsecondary · CVSS-BT (t0sche)
v3.16.9mediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:Nsecondary · NCSC-NL NL
v3.16.9mediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:Nsecondary · CISA US
v3.16.1mediumAV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:Nsecondary · FSTEC (BDU) RU
03

SSVC

Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.

Exploitation: active · Automatable: no · Technical Impact: partialcoordinatorcisa_ssvcUS
04

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-79USprimärCWE-79USCWE-79USCWE-79USCWE-79USCWE-79USCWE-79US
05

Exploits (7)

Öffentlicher Proof-of-Concept- und Exploit-Code.

06

betroffene Produkte (226)

Betroffene Produkte und Versionsbereiche.

20 von 226 angezeigt
07

Advisories (17)

Hersteller- und Ökosystem-Meldungen dazu.

  • FSA-202601Several CODESYS vulnerabilities in Festo Automation Suite2026-02-26csaf · festo_psirtDE

    Starting with Festo Automation Suite (FAS) version 2.8.0.138, the suite is delivered only with a connector to Codesys, rather than including Codesys directly. Prior to this version, Codesys was bundled within the FAS installation. From version 2.8.0.138 onwards, customers are required to download and install Codesys independently. This change impacts the handling of security vulnerabilities (CVEs) related to Codesys. Any Codesys-related security issues must now be addressed by the customer through their separate Codesys installation. The FAS itself includes only the connector component, which is maintained and updated within the suite. Please ensure that Codesys is kept up to date independently to mitigate any potential security risks associated with the Codesys software.

  • NCSC-2024-0417Kwetsbaarheden verholpen in Oracle Fusion MiddlewareNL2024-10-17csaf · ncsc_nlNL

    Oracle heeft kwetsbaarheden verholpen in Fusion Middleware componenten, zoals WebLogic Server, WebCenter en HTTP Server.

  • VDE-2021-027Pepperl+Fuchs: WirelessHART-Gateway - Vulnerability may allow remote attackers to cause a Denial Of Service2021-10-16csaf · pepperl_fuchs_psirtDE

    Critical vulnerabilities have been discovered in the product and in the utilized components jQuery by jQuery Team and TLS Version 1.0/1.1. The impact of the vulnerabilities on the affected device may result in - denial of service - remote code execution - code exposure

  • WID-SEC-W-2022-1347jQuery: Mehrere Schwachstellen ermöglichen Cross-Site ScriptingDeutsch2020-05-03csaf · cert_bundDE

    Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in jQuery ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen.

  • WID-SEC-W-2023-0063Juniper Junos Space: Mehrere SchwachstellenDeutsch2022-01-12csaf · cert_bundDE

    Ein Angreifer aus dem angrenzenden Netzwerk oder ein entfernter anonymer, authentisierter oder lokaler Angreifer kann mehrere Schwachstellen in Juniper Junos Space ausnutzen, um Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand auszulösen, beliebigen Code auszuführen und seine Privilegien zu erweitern.

  • WID-SEC-W-2023-0239Red Hat JBoss Enterprise Application Platform: Mehrere SchwachstellenDeutsch2023-01-31csaf · cert_bundDE

    Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat JBoss Enterprise Application Platform ausnutzen, um beliebigen Programmcode auszuführen, ein Cross-Site-Scritping-Angriff durchzuführen, Informationen offenzulegen, einen Denial of Service Zustand herbeizuführen oder Sicherheitsvorkehrungen zu umgehen.

  • WID-SEC-W-2024-1872IBM QRadar SIEM: Mehrere SchwachstellenDeutsch2021-07-25csaf · cert_bundDE

    Ein entfernter anonymer oder authentifizierter Angreifer kann mehrere Schwachstellen in IBM QRadar SIEM ausnutzen, um vertrauliche Informationen offenzulegen, Sicherheitsmaßnahmen zu umgehen, Dateien zu manipulieren, einen Denial-of-Service-Zustand auszulösen und einen Cross-Site-Scripting-Angriff durchzuführen.

  • WID-SEC-W-2024-3191Oracle Fusion Middleware: Mehrere SchwachstellenDeutsch2024-10-15csaf · cert_bundDE

    Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle Fusion Middleware ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.

  • WID-SEC-W-2025-1459Dell Data Protection Advisor: Mehrere SchwachstellenDeutsch2025-07-03csaf · cert_bundDE

    Ein Angreifer kann mehrere Schwachstellen in Dell Data Protection Advisor ausnutzen, um beliebigen Programmcode auszuführen, um einen Denial of Service Angriff durchzuführen, und um weitere nicht näher spezifizierte Angriffe durchzuführen.

  • WID-SEC-W-2026-3721IBM QRadar SIEM: Mehrere SchwachstellenDeutsch2021-05-04csaf · cert_bundDE

    Ein entfernter, anonymer, authentifizierter, lokaler oder benachbarter Angreifer kann mehrere Schwachstellen in IBM QRadar SIEM ausnutzen, um Informationen offenzulegen, Cross-Site-Scripting-Angriffe durchzuführen, Sicherheitsmaßnahmen zu umgehen, beliebigen Code auszuführen oder einen Denial of Service Zustand auszulösen.

  • GHSA-jpcq-cgw6-v4j6Potential XSS vulnerability in jQuery2020-04-29ghsa · osvUS

    ### Impact Passing HTML containing `<option>` elements from untrusted sources - even after sanitizing them - to one of jQuery's DOM manipulation methods (i.e. `.html()`, `.append()`, and others) may execute untrusted code. ### Patches This problem is patched in jQuery 3.5.0. ### Workarounds To workaround this issue without upgrading, use [DOMPurify](https://github.com/cure53/DOMPurify) with its `SAFE_FOR_JQUERY` option to sanitize the HTML string before passing it to a jQuery method. ### References https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/ ### For more information If you have any questions or comments about this advisory, search for a relevant issue in [the jQuery repo](https://github.com/jquery/jquery/issues). If you don't find an answer, open a new issue.

  • ICSA-21-306-01Sensormatic Electronics VideoEdge2021-11-02icsa · cisa_csaf_otUS

    Successful exploitation of this vulnerability could allow the execution of untrusted code when viewing the VideoEdge admin graphical user interface.

  • ICSA-22-097-01Pepperl+Fuchs WirelessHART-Gateway2022-04-07icsa · cisa_csaf_otUS

    Successful exploitation of these vulnerabilities may result in a denial-of-service condition, code execution, and code exposure.

  • ICSA-25-203-05Schneider Electric System Monitor Application2025-07-08icsa · cisa_csaf_otUS

    Schneider Electric is aware of a vulnerability in its System Monitor application of Harmony Industrial PC and Pro-face PS5000 trusted Legacy industrial PC series products. The Harmony Industrial PC Series and Pro-face PS5000 legacy industrial PC Series are iPCs which incorporate slim, flexible and durable design allowing each customer to configure their iPC based on their individual application needs. These products offer flexible connectivity to a range of devices and designs. Failure to apply the remediations provided below may risk untrusted code execution which could result in operational failures.

  • ICSA-26-076-01CODESYS in Festo Automation Suite2026-02-26icsa · cisa_csaf_otUS

    Starting with Festo Automation Suite (FAS) version 2.8.0.138, the suite is delivered only with a connector to Codesys, rather than including Codesys directly. Prior to this version, Codesys was bundled within the FAS installation. From version 2.8.0.138 onwards, customers are required to download and install Codesys independently. This change impacts the handling of security vulnerabilities (CVEs) related to Codesys. Any Codesys-related security issues must now be addressed by the customer through their separate Codesys installation. The FAS itself includes only the connector component, which is maintained and updated within the suite. Please ensure that Codesys is kept up to date independently to mitigate any potential security risks associated with the Codesys software.

  • BIT-drupal-2020-11023Potential XSS vulnerability in jQuery2024-03-06vendor · osvUS

    In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.

  • CERTFR-2026-AVI-1378Multiples vulnérabilités dans les produits IBMFrançais2026-10-23vendor · certfrFR
08

auch bekannt als (6)

Weitere Namen und Kennungen dieser Entität.

09

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvdenisa_euvdfstec_bduosvcert_bundcisa_csaf_otfesto_psirtncsc_nlpepperl_fuchs_psirtcertfrNVDCVE.orgMITRE
veröffentlicht 2020-04-29geändert 2026-06-17
11

Referenzen (290)

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan