Description
jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Object.prototype.
Published: 2019-04-19
Score: 6.1 Medium
EPSS: 2.7% Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

No analysis available yet.

Remediation

No remediation available yet.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-1777-1 jquery security update
Debian DLA Debian DLA DLA-1797-1 drupal7 security update
Debian DLA Debian DLA DLA-2118-1 otrs2 security update
Debian DLA Debian DLA DLA-3551-1 otrs2 security update
Debian DSA Debian DSA DSA-4434-1 drupal7 security update
Debian DSA Debian DSA DSA-4460-1 mediawiki security update
Github GHSA Github GHSA GHSA-6c3j-c64m-qhgq XSS in jQuery as used in Drupal, Backdrop CMS, and other products
Ubuntu USN Ubuntu USN USN-7622-1 jQuery vulnerabilities
References
Link Providers
http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00006.html cve-icon cve-icon
http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00025.html cve-icon cve-icon
http://packetstormsecurity.com/files/152787/dotCMS-5.1.1-Vulnerable-Dependencies.html cve-icon cve-icon
http://packetstormsecurity.com/files/153237/RetireJS-CORS-Issue-Script-Execution.html cve-icon cve-icon
http://packetstormsecurity.com/files/156743/OctoberCMS-Insecure-Dependencies.html cve-icon cve-icon
http://seclists.org/fulldisclosure/2019/May/10 cve-icon cve-icon
http://seclists.org/fulldisclosure/2019/May/11 cve-icon cve-icon
http://seclists.org/fulldisclosure/2019/May/13 cve-icon cve-icon
http://www.openwall.com/lists/oss-security/2019/06/03/2 cve-icon cve-icon
http://www.securityfocus.com/bid/108023 cve-icon cve-icon
https://access.redhat.com/errata/RHBA-2019:1570 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2019:1456 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2019:2587 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2019:3023 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2019:3024 cve-icon cve-icon
https://backdropcms.org/security/backdrop-sa-core-2019-009 cve-icon cve-icon
https://blog.jquery.com/2019/04/10/jquery-3-4-0-released/ cve-icon cve-icon cve-icon
https://github.com/jquery/jquery/commit/753d591aea698e57d6db58c9f722cd0808619b1b cve-icon cve-icon
https://github.com/jquery/jquery/pull/4333 cve-icon cve-icon
https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44601 cve-icon cve-icon
https://lists.apache.org/thread.html/08720ef215ee7ab3386c05a1a90a7d1c852bf0706f176a7816bf65fc%40%3Ccommits.airflow.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/5928aa293e39d248266472210c50f176cac1535220f2486e6a7fa844%40%3Ccommits.airflow.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/6097cdbd6f0a337bedd9bb5cc441b2d525ff002a96531de367e4259f%40%3Ccommits.airflow.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/88fb0362fd40e5b605ea8149f63241537b8b6fb5bfa315391fc5cbb7%40%3Ccommits.airflow.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/b736d0784cf02f5a30fbb4c5902762a15ad6d47e17e2c5a17b7d6205%40%3Ccommits.airflow.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/ba79cf1658741e9f146e4c59b50aee56656ea95d841d358d006c18b6%40%3Ccommits.roller.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/bcce5a9c532b386c68dab2f6b3ce8b0cc9b950ec551766e76391caa3%40%3Ccommits.nifi.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/r2041a75d3fc09dec55adfd95d598b38d22715303f65c997c054844c9%40%3Cissues.flink.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/r2baacab6e0acb5a2092eb46ae04fd6c3e8277b4fd79b1ffb7f3254fa%40%3Cissues.flink.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/r38f0d1aa3c923c22977fe7376508f030f22e22c1379fbb155bf29766%40%3Cdev.syncope.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/r41b5bfe009c845f67d4f68948cc9419ac2d62e287804aafd72892b08%40%3Cissues.flink.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/r7aac081cbddb6baa24b75e74abf0929bf309b176755a53e3ed810355%40%3Cdev.flink.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/r7d64895cc4dff84d0becfc572b20c0e4bf9bfa7b10c6f5f73e783734%40%3Cdev.storm.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/r7e8ebccb7c022e41295f6fdb7b971209b83702339f872ddd8cf8bf73%40%3Cissues.flink.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/rac25da84ecdcd36f6de5ad0d255f4e967209bbbebddb285e231da37d%40%3Cissues.flink.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b%40%3Ccommits.nifi.apache.org%3E cve-icon cve-icon
https://lists.debian.org/debian-lts-announce/2019/05/msg00006.html cve-icon cve-icon
https://lists.debian.org/debian-lts-announce/2019/05/msg00029.html cve-icon cve-icon
https://lists.debian.org/debian-lts-announce/2020/02/msg00024.html cve-icon cve-icon
https://lists.debian.org/debian-lts-announce/2023/08/msg00040.html cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4UOAZIFCSZ3ENEFOR5IXX6NFAD3HV7FA/ cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5IABSKTYZ5JUGL735UKGXL5YPRYOPUYI/ cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KYH3OAGR2RTCHRA5NOKX2TES7SNQMWGO/ cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QV3PKZC3PQCO3273HAT76PAQZFBEO4KP/ cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RLXRX23725JL366CNZGJZ7AQQB7LHQ6F/ cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WZW27UCJ5CYFL4KFFFMYMIBNMIU2ALG5/ cve-icon cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2019-11358 cve-icon
https://seclists.org/bugtraq/2019/Apr/32 cve-icon cve-icon
https://seclists.org/bugtraq/2019/Jun/12 cve-icon cve-icon
https://seclists.org/bugtraq/2019/May/18 cve-icon cve-icon
https://security.netapp.com/advisory/ntap-20190919-0001/ cve-icon cve-icon
https://snyk.io/vuln/SNYK-JS-JQUERY-174006 cve-icon cve-icon
https://supportportal.juniper.net/s/article/2021-07-Security-Bulletin-Junos-OS-Multiple-J-Web-vulnerabilities-resolved-in-Junos-OS-21-2R1 cve-icon cve-icon
https://www.cve.org/CVERecord?id=CVE-2019-11358 cve-icon
https://www.debian.org/security/2019/dsa-4434 cve-icon cve-icon
https://www.debian.org/security/2019/dsa-4460 cve-icon cve-icon
https://www.drupal.org/sa-core-2019-006 cve-icon cve-icon cve-icon
https://www.oracle.com//security-alerts/cpujul2021.html cve-icon cve-icon
https://www.oracle.com/security-alerts/cpuApr2021.html cve-icon cve-icon
https://www.oracle.com/security-alerts/cpuapr2020.html cve-icon cve-icon
https://www.oracle.com/security-alerts/cpujan2020.html cve-icon cve-icon
https://www.oracle.com/security-alerts/cpujan2021.html cve-icon cve-icon
https://www.oracle.com/security-alerts/cpujan2022.html cve-icon cve-icon
https://www.oracle.com/security-alerts/cpujul2020.html cve-icon cve-icon
https://www.oracle.com/security-alerts/cpuoct2020.html cve-icon cve-icon
https://www.oracle.com/security-alerts/cpuoct2021.html cve-icon cve-icon
https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html cve-icon cve-icon
https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html cve-icon cve-icon
https://www.privacy-wise.com/mitigating-cve-2019-11358-in-old-versions-of-jquery/ cve-icon cve-icon
https://www.synology.com/security/advisory/Synology_SA_19_19 cve-icon cve-icon
https://www.tenable.com/security/tns-2019-08 cve-icon cve-icon
https://www.tenable.com/security/tns-2020-02 cve-icon cve-icon
History

Fri, 11 Jul 2025 13:45:00 +0000

Type Values Removed Values Added
Metrics epss

{'score': 0.02394}

 epss

{'score': 0.02777}

Fri, 15 Nov 2024 15:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Subscriptions

Backdropcms Backdrop
Debian Debian Linux
Drupal Drupal
Fedoraproject Fedora
Joomla Joomla\!
Jquery Jquery
Juniper Junos
Netapp Oncommand System Manager Snapcenter
Opensuse Backports Sle Leap
Oracle Agile Product Lifecycle Management For Process Application Express Application Service Level Management Application Testing Suite Banking Digital Experience Banking Enterprise Collections Banking Platform Bi Publisher Big Data Discovery Business Process Management Suite Communications Analytics Communications Application Session Controller Communications Billing And Revenue Management Communications Diameter Signaling Router Communications Eagle Application Processor Communications Element Manager Communications Interactive Session Recorder Communications Operations Monitor Communications Services Gatekeeper Communications Session Report Manager Communications Session Route Manager Communications Unified Inventory Management Communications Webrtc Session Controller Diagnostic Assistant Enterprise Manager Ops Center Enterprise Session Border Controller Financial Services Analytical Applications Infrastructure Financial Services Analytical Applications Reconciliation Framework Financial Services Asset Liability Management Financial Services Balance Sheet Planning Financial Services Basel Regulatory Capital Basic Financial Services Basel Regulatory Capital Internal Ratings Based Approach Financial Services Data Foundation Financial Services Data Governance For Us Regulatory Reporting Financial Services Data Integration Hub Financial Services Enterprise Financial Performance Analytics Financial Services Funds Transfer Pricing Financial Services Hedge Management And Ifrs Valuations Financial Services Institutional Performance Analytics Financial Services Liquidity Risk Management Financial Services Liquidity Risk Measurement And Management Financial Services Loan Loss Forecasting And Provisioning Financial Services Market Risk Measurement And Management Financial Services Price Creation And Discovery Financial Services Profitability Management Financial Services Regulatory Reporting For De Nederlandsche Bank Financial Services Regulatory Reporting For European Banking Authority Financial Services Regulatory Reporting For Us Federal Reserve Financial Services Retail Customer Analytics Financial Services Retail Performance Analytics Financial Services Revenue Management And Billing Fusion Middleware Mapviewer Healthcare Foundation Healthcare Translational Research Hospitality Guest Access Hospitality Materials Control Hospitality Simphony Identity Manager Insurance Accounting Analyzer Insurance Allocation Manager For Enterprise Profitability Insurance Data Foundation Insurance Ifrs 17 Analyzer Insurance Insbridge Rating And Underwriting Insurance Performance Insight Jd Edwards Enterpriseone Tools Jdeveloper Jdeveloper And Adf Knowledge Peoplesoft Enterprise Peopletools Policy Automation Policy Automation Connector For Siebel Policy Automation For Mobile Devices Primavera Gateway Primavera Unifier Real-time Scheduler Rest Data Services Retail Back Office Retail Central Office Retail Customer Insights Retail Customer Management And Segmentation Foundation Retail Point-of-service Retail Returns Management Service Bus Siebel Mobile Applications Siebel Ui Framework Storagetek Tape Analytics Sw Tool System Utilities Tape Library Acsls Transportation Management Utilities Mobile Workforce Management Webcenter Sites Weblogic Server
Redhat Cloudforms Cloudforms Managementengine Enterprise Linux Jboss Enterprise Application Platform Jboss Single Sign On Openshift Openstack Red Hat Single Sign On Rhev Manager Rhosemc Virtualization Manager
cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published:

Updated: 2024-11-15T15:11:23.024Z

Reserved: 2019-04-19T00:00:00.000Z

Link: CVE-2019-11358

cve-icon Vulnrichment

Updated: 2024-08-04T22:48:09.199Z

cve-icon NVD

Status : Modified

Published: 2019-04-20T00:29:00.247

Modified: 2024-11-21T04:20:56.320

Link: CVE-2019-11358

cve-icon Redhat

Severity : Moderate

Publid Date: 2019-03-27T00:00:00Z

Links: CVE-2019-11358 - Bugzilla

cve-icon OpenCVE Enrichment

No data.

Weaknesses