CVE-2020-11023

mediumpriority · act · 90OT risk · criticalKEV · exploitedEPSS 0.849 · 100 %ileexploit · PoCDEEUFRNLRUUS
grimoire priorityP0 · Act now
Exploitable?
Yes · in the wild
CISA KEV · 7 exploits · PoC
Likely / severe?
84.9% (100th) EPSS
CVSS 4.3 · medium
Is it mine?
226 products
Check your exposure
Who says so?
10 sources
cnnvd · enisa_euvd · fstec_bdu · osv

added 2025-01-23remediate by 2025-02-13

required action Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

EPSS · scored 2026-10-27

JQuery Cross-Site Scripting (XSS) Vulnerability

In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.

01

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

  • FixedVideoEdgecisa_csaf_ot

    Upgrade VideoEdge: to Version 5.7.1

  • FixedSchneider Electric System Monitor application installed on Schneider Electric Harmony Industrial PC All Versionscisa_csaf_ot

    Customer can uninstall System Monitor application using installer available for download here: https://www.se.com/ww/en/product-range/61054- harmony-industrial-pc/#software-and-firmware Please follow the steps described in the guideline attached as a .pdf in the downloaded uninstaller guide.

    https://www.se.com/ww/en/product-range/61054-harmony-industrial-pc/#software-and-firmware
  • FixedSchneider Electric System Monitor application installed on Schneider Electric Pro-face Industrial PC All Versionscisa_csaf_ot

    Customer can uninstall System Monitor application using installer available for download here: https://www.proface.com/en/product/ipc/ps5000/download Please follow the steps described in the guideline attached as a .pdf in the downloaded uninstaller guide.

    https://www.proface.com/en/product/ipc/ps5000/download
  • MitigationFesto Automation Suite <2.8.0.138 installed with CODESYS Development System 3.0festo_psirt

    Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.

  • MitigationFesto Automation Suite <2.8.0.138 installed with CODESYS Development System 3.5.16.10festo_psirt

    Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.

  • Mitigationpepperl_fuchs_psirt

    An external protective measure is required. - Minimize network exposure for affected products and ensure that they are not accessible via the Internet. - Isolate affected products from the corporate network. - If remote access is required, use secure methods such as virtual private networks (VPNs).

  • MitigationVideoEdgecisa_csaf_ot

    For more detailed mitigation and product upgrade instructions, please see Johnson Controls Product Security Advisory JCI-PSA-2021-17 v1

    https://www.johnsoncontrols.com/-/media/jci/cyber-solutions/product-security-advisories/2021/jci-psa-2021-17.pdf
  • MitigationWHA-GW-F2D2-0-AS- Z2-ETHcisa_csaf_ot

    If remote access is required, use secure methods such as virtual private networks (VPNs).

  • MitigationWHA-GW-F2D2-0-AS- Z2-ETH.EIPcisa_csaf_ot

    If remote access is required, use secure methods such as virtual private networks (VPNs).

  • MitigationSchneider Electric System Monitor application installed on Schneider Electric Harmony Industrial PC All Versionscisa_csaf_ot

    If customers choose not to apply the remediation provided above, they should immediately apply the following mitigations to reduce the risk of exploit: • Stop the system monitor if not required by turning off the services as specified in user guide: o Harmony Industrial PC Series User Manual • Setup network segmentation and implement a firewall to block all unauthorized access to configured HTTP/HTTPS ports.

    https://www.se.com/ww/en/download/document/EIO0000002042/
  • MitigationSchneider Electric System Monitor application installed on Schneider Electric Pro-face Industrial PC All Versionscisa_csaf_ot

    If customers choose not to apply the remediation provided above, they should immediately apply the following mitigations to reduce the risk of exploit: • Stop the system monitor if not required by turning off the services as specified in user guide: o Pro-face PS5000 legacy industrial PC Series User Manual • Setup network segmentation and implement a firewall to block all unauthorized access to configured HTTP/HTTPS ports.

    https://www.proface.com/en/node/39458
  • MitigationFesto Automation Suite <2.8.0.138 installed with CODESYS Development System 3.0cisa_csaf_ot

    Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.

  • MitigationFesto Automation Suite <2.8.0.138 installed with CODESYS Development System 3.5.16.10cisa_csaf_ot

    Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.

02

cvss

Technical severity, 0–10. One row per scoring source.

6.9
010

base score 0–10 · higher = more severe · hover a vector to decode

v2.04.3mediumAV:N/AC:M/Au:N/C:N/I:P/A:Nprimary · NVD / NIST USexploitability 8.6 · impact 2.9
v3.16.1mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:Nprimary · NVD / NIST USexploitability 2.8 · impact 2.7
v3.06.1mediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:Nsecondary · CISA US
v3.16.9mediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:Nsecondary · ENISA EU
v3.16.9mediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:Nsecondary · security-advisories@github.comexploitability 1.6 · impact 4.7
v3.16.9mediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N/E:Hsecondary · OSV
v3.16.1mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:Nsecondary · Pepperl+Fuchs PSIRT DE
v3.16.9mediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:Nsecondary · Festo PSIRT DE
v3.16.1mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:Hsecondary · CVSS-BT (t0sche)
v3.16.9mediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:Nsecondary · NCSC-NL NL
v3.16.9mediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:Nsecondary · CISA US
v3.16.1mediumAV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:Nsecondary · FSTEC (BDU) RU
03

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: active · Automatable: no · Technical Impact: partialcoordinatorcisa_ssvcUS
04

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-79USprimaryCWE-79USCWE-79USCWE-79USCWE-79USCWE-79USCWE-79US
05

exploits (7)

Public proof-of-concept and weaponised exploit code.

06

affected products (226)

Products and version ranges known to be affected.

showing 20 of 226
07

advisories (17)

Vendor and ecosystem advisories describing this.

  • FSA-202601Several CODESYS vulnerabilities in Festo Automation Suite2026-02-26csaf · festo_psirtDE

    Starting with Festo Automation Suite (FAS) version 2.8.0.138, the suite is delivered only with a connector to Codesys, rather than including Codesys directly. Prior to this version, Codesys was bundled within the FAS installation. From version 2.8.0.138 onwards, customers are required to download and install Codesys independently. This change impacts the handling of security vulnerabilities (CVEs) related to Codesys. Any Codesys-related security issues must now be addressed by the customer through their separate Codesys installation. The FAS itself includes only the connector component, which is maintained and updated within the suite. Please ensure that Codesys is kept up to date independently to mitigate any potential security risks associated with the Codesys software.

  • NCSC-2024-0417Kwetsbaarheden verholpen in Oracle Fusion MiddlewareNL2024-10-17csaf · ncsc_nlNL

    Oracle heeft kwetsbaarheden verholpen in Fusion Middleware componenten, zoals WebLogic Server, WebCenter en HTTP Server.

  • VDE-2021-027Pepperl+Fuchs: WirelessHART-Gateway - Vulnerability may allow remote attackers to cause a Denial Of Service2021-10-16csaf · pepperl_fuchs_psirtDE

    Critical vulnerabilities have been discovered in the product and in the utilized components jQuery by jQuery Team and TLS Version 1.0/1.1. The impact of the vulnerabilities on the affected device may result in - denial of service - remote code execution - code exposure

  • WID-SEC-W-2022-1347jQuery: Mehrere Schwachstellen ermöglichen Cross-Site ScriptingDeutsch2020-05-03csaf · cert_bundDE

    Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in jQuery ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen.

  • WID-SEC-W-2023-0063Juniper Junos Space: Mehrere SchwachstellenDeutsch2022-01-12csaf · cert_bundDE

    Ein Angreifer aus dem angrenzenden Netzwerk oder ein entfernter anonymer, authentisierter oder lokaler Angreifer kann mehrere Schwachstellen in Juniper Junos Space ausnutzen, um Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand auszulösen, beliebigen Code auszuführen und seine Privilegien zu erweitern.

  • WID-SEC-W-2023-0239Red Hat JBoss Enterprise Application Platform: Mehrere SchwachstellenDeutsch2023-01-31csaf · cert_bundDE

    Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat JBoss Enterprise Application Platform ausnutzen, um beliebigen Programmcode auszuführen, ein Cross-Site-Scritping-Angriff durchzuführen, Informationen offenzulegen, einen Denial of Service Zustand herbeizuführen oder Sicherheitsvorkehrungen zu umgehen.

  • WID-SEC-W-2024-1872IBM QRadar SIEM: Mehrere SchwachstellenDeutsch2021-07-25csaf · cert_bundDE

    Ein entfernter anonymer oder authentifizierter Angreifer kann mehrere Schwachstellen in IBM QRadar SIEM ausnutzen, um vertrauliche Informationen offenzulegen, Sicherheitsmaßnahmen zu umgehen, Dateien zu manipulieren, einen Denial-of-Service-Zustand auszulösen und einen Cross-Site-Scripting-Angriff durchzuführen.

  • WID-SEC-W-2024-3191Oracle Fusion Middleware: Mehrere SchwachstellenDeutsch2024-10-15csaf · cert_bundDE

    Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle Fusion Middleware ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.

  • WID-SEC-W-2025-1459Dell Data Protection Advisor: Mehrere SchwachstellenDeutsch2025-07-03csaf · cert_bundDE

    Ein Angreifer kann mehrere Schwachstellen in Dell Data Protection Advisor ausnutzen, um beliebigen Programmcode auszuführen, um einen Denial of Service Angriff durchzuführen, und um weitere nicht näher spezifizierte Angriffe durchzuführen.

  • WID-SEC-W-2026-3721IBM QRadar SIEM: Mehrere SchwachstellenDeutsch2021-05-04csaf · cert_bundDE

    Ein entfernter, anonymer, authentifizierter, lokaler oder benachbarter Angreifer kann mehrere Schwachstellen in IBM QRadar SIEM ausnutzen, um Informationen offenzulegen, Cross-Site-Scripting-Angriffe durchzuführen, Sicherheitsmaßnahmen zu umgehen, beliebigen Code auszuführen oder einen Denial of Service Zustand auszulösen.

  • GHSA-jpcq-cgw6-v4j6Potential XSS vulnerability in jQuery2020-04-29ghsa · osvUS

    ### Impact Passing HTML containing `<option>` elements from untrusted sources - even after sanitizing them - to one of jQuery's DOM manipulation methods (i.e. `.html()`, `.append()`, and others) may execute untrusted code. ### Patches This problem is patched in jQuery 3.5.0. ### Workarounds To workaround this issue without upgrading, use [DOMPurify](https://github.com/cure53/DOMPurify) with its `SAFE_FOR_JQUERY` option to sanitize the HTML string before passing it to a jQuery method. ### References https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/ ### For more information If you have any questions or comments about this advisory, search for a relevant issue in [the jQuery repo](https://github.com/jquery/jquery/issues). If you don't find an answer, open a new issue.

  • ICSA-21-306-01Sensormatic Electronics VideoEdge2021-11-02icsa · cisa_csaf_otUS

    Successful exploitation of this vulnerability could allow the execution of untrusted code when viewing the VideoEdge admin graphical user interface.

  • ICSA-22-097-01Pepperl+Fuchs WirelessHART-Gateway2022-04-07icsa · cisa_csaf_otUS

    Successful exploitation of these vulnerabilities may result in a denial-of-service condition, code execution, and code exposure.

  • ICSA-25-203-05Schneider Electric System Monitor Application2025-07-08icsa · cisa_csaf_otUS

    Schneider Electric is aware of a vulnerability in its System Monitor application of Harmony Industrial PC and Pro-face PS5000 trusted Legacy industrial PC series products. The Harmony Industrial PC Series and Pro-face PS5000 legacy industrial PC Series are iPCs which incorporate slim, flexible and durable design allowing each customer to configure their iPC based on their individual application needs. These products offer flexible connectivity to a range of devices and designs. Failure to apply the remediations provided below may risk untrusted code execution which could result in operational failures.

  • ICSA-26-076-01CODESYS in Festo Automation Suite2026-02-26icsa · cisa_csaf_otUS

    Starting with Festo Automation Suite (FAS) version 2.8.0.138, the suite is delivered only with a connector to Codesys, rather than including Codesys directly. Prior to this version, Codesys was bundled within the FAS installation. From version 2.8.0.138 onwards, customers are required to download and install Codesys independently. This change impacts the handling of security vulnerabilities (CVEs) related to Codesys. Any Codesys-related security issues must now be addressed by the customer through their separate Codesys installation. The FAS itself includes only the connector component, which is maintained and updated within the suite. Please ensure that Codesys is kept up to date independently to mitigate any potential security risks associated with the Codesys software.

  • BIT-drupal-2020-11023Potential XSS vulnerability in jQuery2024-03-06vendor · osvUS

    In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.

  • CERTFR-2026-AVI-1378Multiples vulnérabilités dans les produits IBMFrançais2026-10-23vendor · certfrFR
08

also known as (6)

Other names and identifiers for this entity.

09

sources

Which sources assert this record, and when.

cnnvdenisa_euvdfstec_bduosvcert_bundcisa_csaf_otfesto_psirtncsc_nlpepperl_fuchs_psirtcertfrNVDCVE.orgMITRE
published 2020-04-29modified 2026-06-17
11

references (290)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan