{
  "document" : {
    "aggregate_severity" : {
      "text" : "mittel"
    },
    "category" : "csaf_base",
    "csaf_version" : "2.0",
    "distribution" : {
      "tlp" : {
        "label" : "WHITE",
        "url" : "https://www.first.org/tlp/"
      }
    },
    "lang" : "de-DE",
    "notes" : [ {
      "category" : "legal_disclaimer",
      "text" : "Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen."
    }, {
      "category" : "description",
      "text" : "jQuery ist eine freie JavaScript-Bibliothek, die Funktionen zur DOM-Navigation und -Manipulation zur Verfügung stellt.",
      "title" : "Produktbeschreibung"
    }, {
      "category" : "summary",
      "text" : "Ein entfernter, anonymer Angreifer kann eine Schwachstelle in jQuery ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen.",
      "title" : "Angriff"
    }, {
      "category" : "general",
      "text" : "- Linux\n- Sonstiges\n- UNIX\n- Windows",
      "title" : "Betroffene Betriebssysteme"
    } ],
    "publisher" : {
      "category" : "other",
      "contact_details" : "csaf-provider@cert-bund.de",
      "name" : "Bundesamt für Sicherheit in der Informationstechnik",
      "namespace" : "https://www.bsi.bund.de"
    },
    "references" : [ {
      "category" : "self",
      "summary" : "WID-SEC-W-2023-0558 - CSAF Version",
      "url" : "https://wid.cert-bund.de/.well-known/csaf/white/2020/wid-sec-w-2023-0558.json"
    }, {
      "category" : "self",
      "summary" : "WID-SEC-2023-0558 - Portal Version",
      "url" : "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2023-0558"
    }, {
      "category" : "external",
      "summary" : "NIST Database CVE-2020-7656 vom 2020-05-25",
      "url" : "https://nvd.nist.gov/vuln/detail/CVE-2020-7656"
    }, {
      "category" : "external",
      "summary" : "PoC auf snyk.io",
      "url" : "https://snyk.io/vuln/SNYK-JS-JQUERY-569619"
    }, {
      "category" : "external",
      "summary" : "Red Hat Security Advisory RHSA-2020:4211 vom 2020-10-08",
      "url" : "https://access.redhat.com/errata/RHSA-2020:4211"
    }, {
      "category" : "external",
      "summary" : "Juniper Security Advisory JSA11203 vom 2021-07-14",
      "url" : "https://kb.juniper.net/InfoCenter/index?page=content&id=JSA11203&cat=SIRT_1"
    }, {
      "category" : "external",
      "summary" : "Red Hat Security Advisory RHSA-2021:4142 vom 2021-11-09",
      "url" : "https://access.redhat.com/errata/RHSA-2021:4142"
    }, {
      "category" : "external",
      "summary" : "Oracle Linux Security Advisory ELSA-2021-9552 vom 2021-11-19",
      "url" : "https://linux.oracle.com/errata/ELSA-2021-9552.html"
    }, {
      "category" : "external",
      "summary" : "Tenable Security Advisory TNS-2023-09 vom 2023-03-02",
      "url" : "https://www.tenable.com/security/tns-2023-09"
    }, {
      "category" : "external",
      "summary" : "SolarWinds Platform 2023.3 Release Notes",
      "url" : "https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/solarwinds_platform_2023-3_release_notes.htm"
    }, {
      "category" : "external",
      "summary" : "IBM Security Bulletin 7060517 vom 2023-10-26",
      "url" : "https://www.ibm.com/support/pages/node/7060517"
    }, {
      "category" : "external",
      "summary" : "IBM Security Bulletin 7148094 vom 2024-04-11",
      "url" : "https://www.ibm.com/support/pages/node/7148094"
    }, {
      "category" : "external",
      "summary" : "IBM Security Bulletin 7150527 vom 2024-05-08",
      "url" : "https://www.ibm.com/support/pages/node/7150527"
    } ],
    "source_lang" : "en-US",
    "title" : "jQuery: Schwachstelle ermöglicht Cross-Site Scripting",
    "tracking" : {
      "current_release_date" : "2024-05-07T22:00:00.000+00:00",
      "generator" : {
        "date" : "2024-08-15T17:46:05.663+00:00",
        "engine" : {
          "name" : "BSI-WID",
          "version" : "1.3.5"
        }
      },
      "id" : "WID-SEC-W-2023-0558",
      "initial_release_date" : "2020-05-25T22:00:00.000+00:00",
      "revision_history" : [ {
        "date" : "2020-05-25T22:00:00.000+00:00",
        "number" : "1",
        "summary" : "Initiale Fassung"
      }, {
        "date" : "2020-10-07T22:00:00.000+00:00",
        "number" : "2",
        "summary" : "Neue Updates von Red Hat aufgenommen"
      }, {
        "date" : "2021-07-14T22:00:00.000+00:00",
        "number" : "3",
        "summary" : "Neue Updates von Juniper aufgenommen"
      }, {
        "date" : "2021-11-09T23:00:00.000+00:00",
        "number" : "4",
        "summary" : "Neue Updates von Red Hat aufgenommen"
      }, {
        "date" : "2021-11-18T23:00:00.000+00:00",
        "number" : "5",
        "summary" : "Neue Updates von Oracle Linux aufgenommen"
      }, {
        "date" : "2023-03-02T23:00:00.000+00:00",
        "number" : "6",
        "summary" : "Neue Updates von Tenable aufgenommen"
      }, {
        "date" : "2023-07-25T22:00:00.000+00:00",
        "number" : "7",
        "summary" : "Neue Updates aufgenommen"
      }, {
        "date" : "2023-10-26T22:00:00.000+00:00",
        "number" : "8",
        "summary" : "Neue Updates von IBM aufgenommen"
      }, {
        "date" : "2024-04-11T22:00:00.000+00:00",
        "number" : "9",
        "summary" : "Neue Updates von IBM aufgenommen"
      }, {
        "date" : "2024-05-07T22:00:00.000+00:00",
        "number" : "10",
        "summary" : "Neue Updates von IBM aufgenommen"
      } ],
      "status" : "final",
      "version" : "10"
    }
  },
  "product_tree" : {
    "branches" : [ {
      "branches" : [ {
        "branches" : [ {
          "category" : "product_version",
          "name" : "7.6.1.2",
          "product" : {
            "name" : "IBM Maximo Asset Management 7.6.1.2",
            "product_id" : "812526",
            "product_identification_helper" : {
              "cpe" : "cpe:/a:ibm:maximo_asset_management:7.6.1.2"
            }
          }
        } ],
        "category" : "product_name",
        "name" : "Maximo Asset Management"
      }, {
        "branches" : [ {
          "category" : "product_version",
          "name" : "7.5",
          "product" : {
            "name" : "IBM QRadar SIEM 7.5",
            "product_id" : "T022954",
            "product_identification_helper" : {
              "cpe" : "cpe:/a:ibm:qradar_siem:7.5"
            }
          }
        } ],
        "category" : "product_name",
        "name" : "QRadar SIEM"
      }, {
        "branches" : [ {
          "category" : "product_version_range",
          "name" : "<5.2.0.0",
          "product" : {
            "name" : "IBM Storage Scale <5.2.0.0",
            "product_id" : "T034454"
          }
        }, {
          "category" : "product_version_range",
          "name" : "<5.1.9-2",
          "product" : {
            "name" : "IBM Storage Scale <5.1.9-2",
            "product_id" : "T034597"
          }
        } ],
        "category" : "product_name",
        "name" : "Storage Scale"
      } ],
      "category" : "vendor",
      "name" : "IBM"
    }, {
      "branches" : [ {
        "category" : "product_name",
        "name" : "Juniper JUNOS",
        "product" : {
          "name" : "Juniper JUNOS",
          "product_id" : "5930",
          "product_identification_helper" : {
            "cpe" : "cpe:/o:juniper:junos:-"
          }
        }
      } ],
      "category" : "vendor",
      "name" : "Juniper"
    }, {
      "branches" : [ {
        "branches" : [ {
          "category" : "product_version_range",
          "name" : "<1.9.0",
          "product" : {
            "name" : "Open Source jQuery <1.9.0",
            "product_id" : "432958"
          }
        } ],
        "category" : "product_name",
        "name" : "jQuery"
      } ],
      "category" : "vendor",
      "name" : "Open Source"
    }, {
      "branches" : [ {
        "category" : "product_name",
        "name" : "Oracle Linux",
        "product" : {
          "name" : "Oracle Linux",
          "product_id" : "T004914",
          "product_identification_helper" : {
            "cpe" : "cpe:/o:oracle:linux:-"
          }
        }
      } ],
      "category" : "vendor",
      "name" : "Oracle"
    }, {
      "branches" : [ {
        "category" : "product_name",
        "name" : "Red Hat Enterprise Linux",
        "product" : {
          "name" : "Red Hat Enterprise Linux",
          "product_id" : "67646",
          "product_identification_helper" : {
            "cpe" : "cpe:/o:redhat:enterprise_linux:-"
          }
        }
      } ],
      "category" : "vendor",
      "name" : "Red Hat"
    }, {
      "branches" : [ {
        "branches" : [ {
          "category" : "product_version_range",
          "name" : "<2023.3",
          "product" : {
            "name" : "SolarWinds Platform <2023.3",
            "product_id" : "T028897"
          }
        } ],
        "category" : "product_name",
        "name" : "Platform"
      } ],
      "category" : "vendor",
      "name" : "SolarWinds"
    }, {
      "branches" : [ {
        "branches" : [ {
          "category" : "product_version_range",
          "name" : "<10.5.0",
          "product" : {
            "name" : "Tenable Security Nessus <10.5.0",
            "product_id" : "T026604"
          }
        } ],
        "category" : "product_name",
        "name" : "Nessus"
      } ],
      "category" : "vendor",
      "name" : "Tenable Security"
    } ]
  },
  "vulnerabilities" : [ {
    "cve" : "CVE-2020-7656",
    "notes" : [ {
      "category" : "description",
      "text" : "In jQuery existiert eine Cross-Site Scripting Schwachstelle. HTML und Script-Eingaben werden nicht ordnungsgemäß überprüft, bevor sie an den Benutzer zurückgegeben werden. Ein entfernter anonymer Angreifer kann durch Ausnutzung dieser Schwachstelle beliebigen HTML- und Script-Code durch den Browser des Benutzers im Kontext der betroffenen Seite ausführen. Zur erfolgreichen Ausnutzung dieser Schwachstelle muss der Angreifer den Benutzer dazu bringen eine modifizierte URL oder Webseite in seinem Webbrowser zu öffnen."
    } ],
    "product_status" : {
      "known_affected" : [ "T022954", "T026604", "67646", "5930", "812526", "T028897", "T004914", "T034454", "T034597" ]
    },
    "release_date" : "2020-05-25T22:00:00.000+00:00",
    "title" : "CVE-2020-7656"
  } ]
}