Back to CVE records
Medium 6.1HealthcarePublished Apr 19, 2019
CVE-2019-11358jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution.
Updated under an hour ago ()
Does this affect you?
It affects jquery and 59 other products. Add what you run to find out whether that includes you.
EPSS puts the chance of exploitation in the next 30 days at 86.82%, higher than 100% of scored CVEs. That is high: schedule it on your emergency patch path.
Do this next
Start free and add your stack
Free account, 1 product
jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Object.prototype.
- CVSS
- 6.1 MEDIUM (v3.1, NVD)CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- 86.82% (percentile 100)
- Assigned by
- mitre
- NVD analysis
- Modified
- Record last updated
- Nov 15, 2024
- First seen by InfoSec Signals
- Oct 12, 2026
Affected products
jquery jquery jquery:jquery | before 3.4.0 | NVD |
debian debian_linux debian:debian_linux | 8.0; 9.0; 10.0 | NVD |
drupal drupal drupal:drupal | from 7.0 before 7.66; from 8.5.0 before 8.5.15; from 8.6.0 before 8.6.15 | NVD |
backdropcms backdrop backdropcms:backdrop | from 1.11.0 before 1.11.9; from 1.12.0 before 1.12.6 | NVD |
fedoraproject fedora fedoraproject:fedora | 28; 29; 30 | NVD |
opensuse backports_sle opensuse:backports_sle | 15.0 | NVD |
opensuse leap opensuse:leap | 15.1 | NVD |
netapp oncommand_system_manager netapp:oncommand_system_manager | from 3.0 through 3.1.3 | NVD |
netapp snapcenter netapp:snapcenter | all versions | NVD |
redhat cloudforms redhat:cloudforms | 4.7 | NVD |
redhat virtualization_manager redhat:virtualization_manager | 4.3 | NVD |
oracle agile_product_lifecycle_management_for_process oracle:agile_product_lifecycle_management_for_process | 6.1; 6.2.0.0; 6.2.1.0; 6.2.2.0; 6.2.3.0 | NVD |
oracle application_express oracle:application_express | before 19.1 | NVD |
oracle application_service_level_management oracle:application_service_level_management | 13.2.0.0; 13.3.0.0 | NVD |
oracle application_testing_suite oracle:application_testing_suite | 12.5.0.3; 13.1.0.1; 13.2; 13.2.0.1; 13.3; 13.3.0.1 | NVD |
oracle banking_digital_experience oracle:banking_digital_experience | 18.1; 18.2; 18.3; 19.1; 19.2; 20.1 | NVD |
oracle banking_enterprise_collections oracle:banking_enterprise_collections | from 2.7.0 through 2.8.0 | NVD |
oracle banking_platform oracle:banking_platform | from 2.4.0 through 2.10.0 | NVD |
oracle bi_publisher oracle:bi_publisher | 5.5.0.0.0; 12.2.1.3.0; 12.2.1.4.0 | NVD |
oracle big_data_discovery oracle:big_data_discovery | 1.6 | NVD |
oracle business_process_management_suite oracle:business_process_management_suite | 12.2.1.3.0; 12.2.1.4.0 | NVD |
oracle communications_analytics oracle:communications_analytics | 12.1.1 | NVD |
oracle communications_application_session_controller oracle:communications_application_session_controller | 3.8m0 | NVD |
oracle communications_billing_and_revenue_management oracle:communications_billing_and_revenue_management | 7.5; 7.5.0.23.0; 12.0; 12.0.0.3.0 | NVD |
oracle communications_diameter_signaling_router oracle:communications_diameter_signaling_router | 8.0.0; 8.1; 8.2; 8.2.1 | NVD |
oracle communications_eagle_application_processor oracle:communications_eagle_application_processor | from 16.1.0 through 16.4.0 | NVD |
oracle communications_element_manager oracle:communications_element_manager | 8.1.1; 8.2.0; 8.2.1 | NVD |
oracle communications_interactive_session_recorder oracle:communications_interactive_session_recorder | from 6.0 through 6.4 | NVD |
oracle communications_operations_monitor oracle:communications_operations_monitor | from 4.1 through 4.3; 3.4; 4.0; 4.1.0 | NVD |
oracle communications_services_gatekeeper oracle:communications_services_gatekeeper | 7.0 | NVD |
oracle communications_session_report_manager oracle:communications_session_report_manager | 8.1.1; 8.2.0; 8.2.1 | NVD |
oracle communications_session_route_manager oracle:communications_session_route_manager | 8.1.1; 8.2.0; 8.2.1 | NVD |
oracle communications_unified_inventory_management oracle:communications_unified_inventory_management | 7.3; 7.4.0 | NVD |
oracle communications_webrtc_session_controller oracle:communications_webrtc_session_controller | 7.2 | NVD |
oracle diagnostic_assistant oracle:diagnostic_assistant | 2.12.36 | NVD |
oracle enterprise_manager_ops_center oracle:enterprise_manager_ops_center | 12.3.3; 12.4.0; 12.4.0.0 | NVD |
oracle enterprise_session_border_controller oracle:enterprise_session_border_controller | 8.4 | NVD |
oracle financial_services_analytical_applications_infrastructure oracle:financial_services_analytical_applications_infrastructure | from 7.3.3 through 7.3.5; from 8.0.2 through 8.1.0 | NVD |
oracle financial_services_analytical_applications_reconciliation_framework oracle:financial_services_analytical_applications_reconciliation_framework | from 8.0.4 through 8.0.7; 8.1.0 | NVD |
oracle financial_services_asset_liability_management oracle:financial_services_asset_liability_management | from 8.0.4 through 8.0.7; 8.1.0 | NVD |
oracle financial_services_balance_sheet_planning oracle:financial_services_balance_sheet_planning | 8.0.8 | NVD |
oracle financial_services_basel_regulatory_capital_basic oracle:financial_services_basel_regulatory_capital_basic | from 8.0.4 through 8.0.7; 8.1.0 | NVD |
oracle financial_services_basel_regulatory_capital_internal_ratings_based_approach oracle:financial_services_basel_regulatory_capital_internal_ratings_based_approach | from 8.0.4 through 8.0.7; 8.1.0 | NVD |
oracle financial_services_data_foundation oracle:financial_services_data_foundation | from 8.0.4 through 8.0.8 | NVD |
oracle financial_services_data_governance_for_us_regulatory_reporting oracle:financial_services_data_governance_for_us_regulatory_reporting | from 8.0.6 through 8.0.9 | NVD |
oracle financial_services_data_integration_hub oracle:financial_services_data_integration_hub | from 8.0.5 through 8.0.7; 8.1.0 | NVD |
oracle financial_services_enterprise_financial_performance_analytics oracle:financial_services_enterprise_financial_performance_analytics | 8.0.6; 8.0.7 | NVD |
oracle financial_services_funds_transfer_pricing oracle:financial_services_funds_transfer_pricing | from 8.0.4 through 8.0.7; 8.1.0 | NVD |
oracle financial_services_hedge_management_and_ifrs_valuations oracle:financial_services_hedge_management_and_ifrs_valuations | from 8.0.4 through 8.0.7; 8.1.0 | NVD |
oracle financial_services_institutional_performance_analytics oracle:financial_services_institutional_performance_analytics | from 8.0.4 through 8.0.7; 8.1.0 | NVD |
oracle financial_services_liquidity_risk_management oracle:financial_services_liquidity_risk_management | 8.0.0.1.0; 8.0.2; 8.0.4.0.0; 8.0.5.0.0; 8.0.6 | NVD |
oracle financial_services_liquidity_risk_measurement_and_management oracle:financial_services_liquidity_risk_measurement_and_management | 8.0.7; 8.0.8; 8.1.0 | NVD |
oracle financial_services_loan_loss_forecasting_and_provisioning oracle:financial_services_loan_loss_forecasting_and_provisioning | from 8.0.2 through 8.0.7; 8.1.0 | NVD |
oracle financial_services_market_risk_measurement_and_management oracle:financial_services_market_risk_measurement_and_management | 8.0.5; 8.0.6; 8.0.8 | NVD |
oracle financial_services_price_creation_and_discovery oracle:financial_services_price_creation_and_discovery | from 8.0.4 through 8.0.7 | NVD |
oracle financial_services_profitability_management oracle:financial_services_profitability_management | from 8.0.4 through 8.0.7; 8.1.0 | NVD |
oracle financial_services_regulatory_reporting_for_de_nederlandsche_bank oracle:financial_services_regulatory_reporting_for_de_nederlandsche_bank | 8.0.4 | NVD |
oracle financial_services_regulatory_reporting_for_european_banking_authority oracle:financial_services_regulatory_reporting_for_european_banking_authority | 8.0.6; 8.0.7 | NVD |
oracle financial_services_regulatory_reporting_for_us_federal_reserve oracle:financial_services_regulatory_reporting_for_us_federal_reserve | from 8.0.4 through 8.0.7 | NVD |
oracle financial_services_retail_customer_analytics oracle:financial_services_retail_customer_analytics | from 8.0.4 through 8.0.6 | NVD |
References
- https://www.drupal.org/sa-core-2019-006
- https://www.synology.com/security/advisory/Synology_SA_19_19
- https://www.debian.org/security/2019/dsa-4434vendor-advisory
- https://seclists.org/bugtraq/2019/Apr/32mailing-list
- http://www.securityfocus.com/bid/108023vdb-entry, broken-link, third-party-advisory
- https://lists.apache.org/thread.html/08720ef215ee7ab3386c05a1a90a7d1c852bf0706f176a7816bf65fc%40%3Ccommits.airflow.apache.org%3Emailing-list, issue-tracking
- https://lists.apache.org/thread.html/b736d0784cf02f5a30fbb4c5902762a15ad6d47e17e2c5a17b7d6205%40%3Ccommits.airflow.apache.org%3Emailing-list
- https://lists.apache.org/thread.html/88fb0362fd40e5b605ea8149f63241537b8b6fb5bfa315391fc5cbb7%40%3Ccommits.airflow.apache.org%3Emailing-list, issue-tracking
- https://lists.apache.org/thread.html/5928aa293e39d248266472210c50f176cac1535220f2486e6a7fa844%40%3Ccommits.airflow.apache.org%3Emailing-list, issue-tracking
- https://lists.apache.org/thread.html/6097cdbd6f0a337bedd9bb5cc441b2d525ff002a96531de367e4259f%40%3Ccommits.airflow.apache.org%3Emailing-list, issue-tracking
- https://lists.debian.org/debian-lts-announce/2019/05/msg00006.htmlmailing-list
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5IABSKTYZ5JUGL735UKGXL5YPRYOPUYI/vendor-advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4UOAZIFCSZ3ENEFOR5IXX6NFAD3HV7FA/vendor-advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KYH3OAGR2RTCHRA5NOKX2TES7SNQMWGO/vendor-advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RLXRX23725JL366CNZGJZ7AQQB7LHQ6F/vendor-advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QV3PKZC3PQCO3273HAT76PAQZFBEO4KP/vendor-advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WZW27UCJ5CYFL4KFFFMYMIBNMIU2ALG5/vendor-advisory
- https://seclists.org/bugtraq/2019/May/18mailing-list
- http://packetstormsecurity.com/files/152787/dotCMS-5.1.1-Vulnerable-Dependencies.htmlthird-party-advisory, vdb-entry
- http://seclists.org/fulldisclosure/2019/May/11mailing-list, patch, third-party-advisory
- http://seclists.org/fulldisclosure/2019/May/10mailing-list, third-party-advisory
- http://seclists.org/fulldisclosure/2019/May/13mailing-list, patch, third-party-advisory
- https://lists.debian.org/debian-lts-announce/2019/05/msg00029.htmlmailing-list
- http://www.openwall.com/lists/oss-security/2019/06/03/2mailing-list, patch, third-party-advisory
- http://packetstormsecurity.com/files/153237/RetireJS-CORS-Issue-Script-Execution.htmlthird-party-advisory, vdb-entry
- http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00006.htmlmailing-list, third-party-advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00025.htmlmailing-list, third-party-advisory
- http://packetstormsecurity.com/files/156743/OctoberCMS-Insecure-Dependencies.htmlthird-party-advisory, vdb-entry
- https://access.redhat.com/errata/RHBA-2019:1570third-party-advisory
- https://access.redhat.com/errata/RHSA-2019:1456third-party-advisory
- https://access.redhat.com/errata/RHSA-2019:2587third-party-advisory
- https://access.redhat.com/errata/RHSA-2019:3023third-party-advisory
- https://access.redhat.com/errata/RHSA-2019:3024third-party-advisory
- https://backdropcms.org/security/backdrop-sa-core-2019-009third-party-advisory
- https://blog.jquery.com/2019/04/10/jquery-3-4-0-released/release-notes, vendor-advisory
- https://github.com/jquery/jquery/commit/753d591aea698e57d6db58c9f722cd0808619b1bpatch, third-party-advisory
- https://github.com/jquery/jquery/pull/4333patch, third-party-advisory
- https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44601third-party-advisory
- https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3Eissue-tracking
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.