# CVE-2020-23064: Duplicate Advisory: jQuery Cross Site Scripting vulnerability

> CVE-2020-23064 is a rejected CVE ID: the CVE Program withdrew it, so it doesn't describe a valid vulnerability.

Canonical page: https://cveminer.com/vulnerabilities/CVE-2020-23064

| Field | Value |
| --- | --- |
| CVE | CVE-2020-23064 |
| GHSA | GHSA-257q-pv89-v3xv |
| Severity | Medium |
| CVSS 3.1 | 6.1 `CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N` (GitHub Advisory Database) |
| CWE | CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
| EPSS | 0.04% (higher than 21% of CVEs) |
| CISA KEV | Not listed |
| Published | 26 Jun 2023 |
| Modified | 15 May 2024 |
| Withdrawn | 15 May 2024 |
| Status | Rejected by the CVE Program |

## Description

#### Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of [GHSA-jpcq-cgw6-v4j6](https://github.com/advisories/GHSA-jpcq-cgw6-v4j6). This link is maintained to preserve external references.

#### Original Description

Cross Site Scripting vulnerability in jQuery v.2.2.0 until v.3.5.0 allows a remote attacker to execute arbitrary code via the `<options>` element.

## Affected packages

| Package | Ecosystem | PURL | Vulnerable versions | Fixed in |
| --- | --- | --- | --- | --- |
| jquery | npm | `pkg:npm/jquery` | >= 1.0.3, < 3.5.0 | 3.5.0 |
| jQuery | NuGet | `pkg:nuget/jQuery` | >= 1.0.3, < 3.5.0 | 3.5.0 |
| jquery-rails | RubyGems | `pkg:gem/jquery-rails` | < 4.4.0 | 4.4.0 |
| org.webjars.npm:jquery | Maven | `pkg:maven/org.webjars.npm/jquery` | >= 1.0.3, < 3.5.0 | 3.5.0 |

## Fix commits

- Patch: https://github.com/jquery/jquery/commit/1d61fd9407e6fbe82fe55cb0b938307aa0791f77

## References

- https://github.com/jquery/jquery/commit/1d61fd9407e6fbe82fe55cb0b938307aa0791f77 (fix)
- https://nvd.nist.gov/vuln/detail/CVE-2020-23064 (advisory)
- https://github.com/advisories/GHSA-jpcq-cgw6-v4j6 (advisory)
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/jquery-rails/CVE-2020-23064.yml (advisory)
- https://github.com/advisories/GHSA-257q-pv89-v3xv (advisory)
- https://github.com/jquery/jquery (package)
- https://blog.jquery.com/2020/04/10/jquery-3-5-0-released
- https://github.com/rails/jquery-rails/blob/master/CHANGELOG.md#410
- https://github.com/rails/jquery-rails/blob/v4.3.5/vendor/assets/javascripts/jquery3.js#L5979
- https://github.com/rails/jquery-rails/blob/v4.4.0/vendor/assets/javascripts/jquery3.js#L6162
- https://security.netapp.com/advisory/ntap-20230725-0003
- https://snyk.io/vuln/SNYK-JS-JQUERY-565129

---

Source: CVEminer (https://cveminer.com/vulnerabilities/CVE-2020-23064), compiled from OSV (GitHub advisory), GitHub Advisory Database, CVE.org, CISA KEV catalog. OSV and GitHub Advisory Database content is licensed CC BY 4.0.