VDB
RHBA-2025%3A1597
RHBA-2025%3A1597
PUBLISHED
CVSS 6.099999904632568 MEDIUM
A flaw was found in jQuery. HTML containing \<option\> elements from untrusted sources are passed, even after sanitizing, to one of jQuery's DOM manipulation methods, which may execute untrusted code. The highest threat from this vulnerability is to data confidentiality and integrity.
Risk Scores
CVSS 3.1
6.099999904632568
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | quay/quay-bridge-operator-rhel8@sha256:98579eac921a1f826a0076bce00630df914bc828846cb266871330fb84465026_amd64 as a component of Quay v3 | quay/quay-bridge-operator-rhel8@sha256:98579eac921a1f826a0076bce00630df914bc828846cb266871330fb84465026_amd64, * |
| Red Hat | quay/quay-builder-rhel8@sha256:e7a5ff90f004faeeda52d504f7d4396e2952f5b0021c69d5176e189b25eafec0_amd64 as a component of Quay v3 | *, quay/quay-builder-rhel8@sha256:e7a5ff90f004faeeda52d504f7d4396e2952f5b0021c69d5176e189b25eafec0_amd64 |
| Red Hat | quay/quay-bridge-operator-bundle@sha256:2e29f557653b8b39d560ad20d04fa3059a82a8e7a91a38759abbf0ad5e407277_amd64 as a component of Quay v3 | quay/quay-bridge-operator-bundle@sha256:2e29f557653b8b39d560ad20d04fa3059a82a8e7a91a38759abbf0ad5e407277_amd64, * |
| Red Hat | quay/quay-operator-rhel8@sha256:4305f51c514c95b6a03b5f6390c624dfed6fed361d6e7b0e6f270912e6aeb7c8_amd64 as a component of Quay v3 | quay/quay-operator-rhel8@sha256:4305f51c514c95b6a03b5f6390c624dfed6fed361d6e7b0e6f270912e6aeb7c8_amd64, * |
| Red Hat | quay/quay-operator-bundle@sha256:923b0084f2f6c0c8e097c12fd0b381314b1f2f407ab77a49b97d837c88c8d641_amd64 as a component of Quay v3 | *, quay/quay-operator-bundle@sha256:923b0084f2f6c0c8e097c12fd0b381314b1f2f407ab77a49b97d837c88c8d641_amd64 |
| Red Hat | quay/clair-rhel8@sha256:be5aa55fd2dac0cf68de95b4838d9d4036a74498b0105e51700de04ea927178d_amd64 as a component of Quay v3 | quay/clair-rhel8@sha256:be5aa55fd2dac0cf68de95b4838d9d4036a74498b0105e51700de04ea927178d_amd64, * |
| Red Hat | quay/quay-container-security-operator-rhel8@sha256:65b1b3bd0d998b41a80b47d4ec4b2f78dea39e1e68d06c110ac39103f5f09984_amd64 as a component of Quay v3 | quay/quay-container-security-operator-rhel8@sha256:65b1b3bd0d998b41a80b47d4ec4b2f78dea39e1e68d06c110ac39103f5f09984_amd64, * |
| Red Hat | quay/quay-container-security-operator-bundle@sha256:367ea9ce8fd4214c1c88d4954501aed7573ab5d6c914815a5f16c65d14f95636_amd64 as a component of Quay v3 | *, * |
| Red Hat | quay/quay-rhel8@sha256:222815636c389658b5692de815033013bc6cd7760a169eff664b2caabf44ec24_amd64 as a component of Quay v3 | *, quay/quay-rhel8@sha256:222815636c389658b5692de815033013bc6cd7760a169eff664b2caabf44ec24_amd64 |
| Red Hat | quay/quay-builder-qemu-rhcos-rhel8@sha256:4516ea12db56b25d13631446b6d6cbd9f8feac7e4aff6eb25ac0e360e3a4fa01_amd64 as a component of Quay v3 | *, quay/quay-builder-qemu-rhcos-rhel8@sha256:4516ea12db56b25d13631446b6d6cbd9f8feac7e4aff6eb25ac0e360e3a4fa01_amd64 |
Timeline
- Feb 24, 2025 CVE Published
- May 10, 2026 Security Advisory
- May 10, 2026 Security Advisory
- May 16, 2026 CVE Updated
References
- https://access.redhat.com/errata/RHBA-2025:1597 advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhba-2025_1597.json advisory
- https://access.redhat.com/security/cve/CVE-2020-11023 advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1850004 issue
- https://www.cve.org/CVERecord?id=CVE-2020-11023 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2020-11023 advisory
- https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/ advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog exploit