CVE-2020-7656

2020-05-1900:00:00

snyk

www.cve.org

6.2 Medium

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

51.9%

JSON

jquery prior to 1.9.0 allows Cross-site Scripting attacks via the load method. The load method fails to recognize and remove “<script>” HTML tags that contain a whitespace character, i.e: “</script >”, which results in the enclosed script logic to be executed.

CNA Affected

[
  {
    "vendor": "n/a",
    "product": "jquery",
    "versions": [
      {
        "version": "All versions prior to version 1.9.0",
        "status": "affected"
      }
    ]
  }
]