Cross-site scripting in jQuery - CVE-2020-23064

Vulnerability identifier: #VU80757

CSH Severity: Medium

CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]

CVE-ID: CVE-2020-23064

CWE-ID: CWE-79

Exploitation vector: Remote access

Exploit availability: No public exploit available

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data in jQuery 2. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

jQuery
Cloud Pak for Security (CP4S)
Juniper Secure Analytics (JSA)
openEuler
Log Analysis
IBM Decision Optimization for Cloud Pak for Data
IBM Security Verify Governance - Containerized Identity Manager
doxygen-debugsource
doxygen-debuginfo
doxygen-doxywizard
doxygen
Storage Copy Data Management
DB2 on Cloud Pak for Data
DB2 Warehouse on Cloud Pak for Data
IBM Engineering Lifecycle Optimization - Publishing
Robotic Process Automation for Cloud Pak
SINEMA Remote Connect Server
IBM Storage Scale System
AMQ Broker

Cybersecurity Help is currently unaware of any official solution to address this vulnerability..

jQuery - update to 3.5.0
Cloud Pak for Security (CP4S) - update to 1.10.15.0
Juniper Secure Analytics (JSA) - update to 7.5.0 UP9 IF02
Log Analysis - update to 1.3.8
doxygen-debugsource - update to 1.8.17-8
doxygen-debuginfo - update to 1.8.17-8
doxygen-doxywizard - update to 1.8.17-8
doxygen - update to 1.8.17-8
Storage Copy Data Management - update to 2.2.26.0
SINEMA Remote Connect Server - update to 3.1
DB2 on Cloud Pak for Data - update to 4.8.5
DB2 Warehouse on Cloud Pak for Data - update to 4.8.5
IBM Decision Optimization for Cloud Pak for Data - update to 5.0
IBM Storage Scale System - addressed in versions 5.1.9.7, 5.2.2.0
IBM Engineering Lifecycle Optimization - Publishing - addressed in versions 7.0.2.27, 7.0.3.2
AMQ Broker - update to 7.13.0
IBM Security Verify Governance - Containerized Identity Manager - update to 10.0.2
Robotic Process Automation for Cloud Pak - addressed in versions 21.0.7.10, 23.0.10

• https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/
• https://snyk.io/vuln/SNYK-JS-JQUERY-565129
• https://security.netapp.com/advisory/ntap-20230725-0003/

• Multiple vulnerabilities in IBM Cloud Pak for Security (CP4S)
• Multiple vulnerabilities in IBM Robotic Process Automation for Cloud Pak
• Multiple vulnerabilities in IBM Operations Analytics
• Multiple vulnerabilities in IBM Engineering Lifecycle Optimization - Publishing (PUB)
• openEuler 20.03 LTS SP1 update for doxygen
• openEuler 20.03 LTS SP3 update for doxygen
• Cross-site scripting in Siemens SINEMA Remote Connect Server
• Multiple vulnerabilities in IBM Db2 on Cloud Pak for Data, and Db2 Warehouse on Cloud Pak for Data
• Cross-site scripting in IBM Decision Optimization for Cloud Pak for Data
• Multiple vulnerabilities in IBM Security Verify Governance - Containerized Identity Manager
• Multiple vulnerabilities in Juniper Secure Analytics (JSA)
• Multiple vulnerabilities in IBM Storage Scale
• Multiple vulnerabilities in AMQ Broker 7.13
• Multiple vulnerabilities in IBM Storage Copy Data Management