jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Object.prototype.
Project Subscriptions
| Vendors | Products |
|---|---|
|
Backdropcms
Subscribe
|
Backdrop
Subscribe
|
|
Debian
Subscribe
|
Debian Linux
Subscribe
|
|
Drupal
Subscribe
|
Drupal
Subscribe
|
|
Fedoraproject
Subscribe
|
Fedora
Subscribe
|
|
Joomla
Subscribe
|
Joomla\!
Subscribe
|
|
Jquery
Subscribe
|
Jquery
Subscribe
|
|
Juniper
Subscribe
|
Junos
Subscribe
|
|
Netapp
Subscribe
|
|
|
Opensuse
Subscribe
|
|
|
Oracle
Subscribe
|
Agile Product Lifecycle Management For Process
Subscribe
Application Express
Subscribe
Application Service Level Management
Subscribe
Application Testing Suite
Subscribe
Banking Digital Experience
Subscribe
Banking Enterprise Collections
Subscribe
Banking Platform
Subscribe
Bi Publisher
Subscribe
Big Data Discovery
Subscribe
Business Process Management Suite
Subscribe
Communications Analytics
Subscribe
Communications Application Session Controller
Subscribe
Communications Billing And Revenue Management
Subscribe
Communications Diameter Signaling Router
Subscribe
Communications Eagle Application Processor
Subscribe
Communications Element Manager
Subscribe
Communications Interactive Session Recorder
Subscribe
Communications Operations Monitor
Subscribe
Communications Services Gatekeeper
Subscribe
Communications Session Report Manager
Subscribe
Communications Session Route Manager
Subscribe
Communications Unified Inventory Management
Subscribe
Communications Webrtc Session Controller
Subscribe
Diagnostic Assistant
Subscribe
Enterprise Manager Ops Center
Subscribe
Enterprise Session Border Controller
Subscribe
Financial Services Analytical Applications Infrastructure
Subscribe
Financial Services Analytical Applications Reconciliation Framework
Subscribe
Financial Services Asset Liability Management
Subscribe
Financial Services Balance Sheet Planning
Subscribe
Financial Services Basel Regulatory Capital Basic
Subscribe
Financial Services Basel Regulatory Capital Internal Ratings Based Approach
Subscribe
Financial Services Data Foundation
Subscribe
Financial Services Data Governance For Us Regulatory Reporting
Subscribe
Financial Services Data Integration Hub
Subscribe
Financial Services Enterprise Financial Performance Analytics
Subscribe
Financial Services Funds Transfer Pricing
Subscribe
Financial Services Hedge Management And Ifrs Valuations
Subscribe
Financial Services Institutional Performance Analytics
Subscribe
Financial Services Liquidity Risk Management
Subscribe
Financial Services Liquidity Risk Measurement And Management
Subscribe
Financial Services Loan Loss Forecasting And Provisioning
Subscribe
Financial Services Market Risk Measurement And Management
Subscribe
Financial Services Price Creation And Discovery
Subscribe
Financial Services Profitability Management
Subscribe
Financial Services Regulatory Reporting For De Nederlandsche Bank
Subscribe
Financial Services Regulatory Reporting For European Banking Authority
Subscribe
Financial Services Regulatory Reporting For Us Federal Reserve
Subscribe
Financial Services Retail Customer Analytics
Subscribe
Financial Services Retail Performance Analytics
Subscribe
Financial Services Revenue Management And Billing
Subscribe
Fusion Middleware Mapviewer
Subscribe
Healthcare Foundation
Subscribe
Healthcare Translational Research
Subscribe
Hospitality Guest Access
Subscribe
Hospitality Materials Control
Subscribe
Hospitality Simphony
Subscribe
Identity Manager
Subscribe
Insurance Accounting Analyzer
Subscribe
Insurance Allocation Manager For Enterprise Profitability
Subscribe
Insurance Data Foundation
Subscribe
Insurance Ifrs 17 Analyzer
Subscribe
Insurance Insbridge Rating And Underwriting
Subscribe
Insurance Performance Insight
Subscribe
Jd Edwards Enterpriseone Tools
Subscribe
Jdeveloper
Subscribe
Jdeveloper And Adf
Subscribe
Knowledge
Subscribe
Peoplesoft Enterprise Peopletools
Subscribe
Policy Automation
Subscribe
Policy Automation Connector For Siebel
Subscribe
Policy Automation For Mobile Devices
Subscribe
Primavera Gateway
Subscribe
Primavera Unifier
Subscribe
Real-time Scheduler
Subscribe
Rest Data Services
Subscribe
Retail Back Office
Subscribe
Retail Central Office
Subscribe
Retail Customer Insights
Subscribe
Retail Customer Management And Segmentation Foundation
Subscribe
Retail Point-of-service
Subscribe
Retail Returns Management
Subscribe
Service Bus
Subscribe
Siebel Mobile Applications
Subscribe
Siebel Ui Framework
Subscribe
Storagetek Tape Analytics Sw Tool
Subscribe
System Utilities
Subscribe
Tape Library Acsls
Subscribe
Transportation Management
Subscribe
Utilities Mobile Workforce Management
Subscribe
Webcenter Sites
Subscribe
Weblogic Server
Subscribe
|
|
Redhat
Subscribe
|
Cloudforms
Subscribe
Cloudforms Managementengine
Subscribe
Enterprise Linux
Subscribe
Jboss Enterprise Application Platform
Subscribe
Jboss Single Sign On
Subscribe
Openshift
Subscribe
Openstack
Subscribe
Red Hat Single Sign On
Subscribe
Rhev Manager
Subscribe
Rhosemc
Subscribe
Virtualization Manager
Subscribe
|
Advisories
| Source | ID | Title |
|---|---|---|
Debian DLA |
DLA-1777-1 | jquery security update |
Debian DLA |
DLA-1797-1 | drupal7 security update |
Debian DLA |
DLA-2118-1 | otrs2 security update |
Debian DLA |
DLA-3551-1 | otrs2 security update |
Debian DSA |
DSA-4434-1 | drupal7 security update |
Debian DSA |
DSA-4460-1 | mediawiki security update |
Github GHSA |
GHSA-6c3j-c64m-qhgq | XSS in jQuery as used in Drupal, Backdrop CMS, and other products |
Ubuntu USN |
USN-7622-1 | jQuery vulnerabilities |
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Fri, 11 Jul 2025 13:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
epss
|
epss
|
Fri, 15 Nov 2024 15:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Projects
Sign in to view the affected projects.
Status: PUBLISHED
Assigner: mitre
Published:
Updated: 2024-11-15T15:11:23.024Z
Reserved: 2019-04-19T00:00:00.000Z
Link: CVE-2019-11358
Updated: 2024-08-04T22:48:09.199Z
Status : Modified
Published: 2019-04-20T00:29:00.247
Modified: 2024-11-21T04:20:56.320
Link: CVE-2019-11358
OpenCVE Enrichment
No data.
Debian DLA
Debian DSA
Github GHSA
Ubuntu USN