jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Object.prototype.

Project Subscriptions

Vendors Products
Backdropcms Subscribe
Backdrop Subscribe
Debian Linux Subscribe
Fedoraproject Subscribe
Joomla\! Subscribe
Juniper Subscribe
Oncommand System Manager Subscribe
Snapcenter Subscribe
Opensuse Subscribe
Backports Sle Subscribe
Agile Product Lifecycle Management For Process Subscribe
Application Express Subscribe
Application Service Level Management Subscribe
Application Testing Suite Subscribe
Banking Digital Experience Subscribe
Banking Enterprise Collections Subscribe
Banking Platform Subscribe
Bi Publisher Subscribe
Big Data Discovery Subscribe
Business Process Management Suite Subscribe
Communications Analytics Subscribe
Communications Application Session Controller Subscribe
Communications Billing And Revenue Management Subscribe
Communications Diameter Signaling Router Subscribe
Communications Eagle Application Processor Subscribe
Communications Element Manager Subscribe
Communications Interactive Session Recorder Subscribe
Communications Operations Monitor Subscribe
Communications Services Gatekeeper Subscribe
Communications Session Report Manager Subscribe
Communications Session Route Manager Subscribe
Communications Unified Inventory Management Subscribe
Communications Webrtc Session Controller Subscribe
Diagnostic Assistant Subscribe
Enterprise Manager Ops Center Subscribe
Enterprise Session Border Controller Subscribe
Financial Services Analytical Applications Infrastructure Subscribe
Financial Services Analytical Applications Reconciliation Framework Subscribe
Financial Services Asset Liability Management Subscribe
Financial Services Balance Sheet Planning Subscribe
Financial Services Basel Regulatory Capital Basic Subscribe
Financial Services Basel Regulatory Capital Internal Ratings Based Approach Subscribe
Financial Services Data Foundation Subscribe
Financial Services Data Governance For Us Regulatory Reporting Subscribe
Financial Services Data Integration Hub Subscribe
Financial Services Enterprise Financial Performance Analytics Subscribe
Financial Services Funds Transfer Pricing Subscribe
Financial Services Hedge Management And Ifrs Valuations Subscribe
Financial Services Institutional Performance Analytics Subscribe
Financial Services Liquidity Risk Management Subscribe
Financial Services Liquidity Risk Measurement And Management Subscribe
Financial Services Loan Loss Forecasting And Provisioning Subscribe
Financial Services Market Risk Measurement And Management Subscribe
Financial Services Price Creation And Discovery Subscribe
Financial Services Profitability Management Subscribe
Financial Services Regulatory Reporting For De Nederlandsche Bank Subscribe
Financial Services Regulatory Reporting For European Banking Authority Subscribe
Financial Services Regulatory Reporting For Us Federal Reserve Subscribe
Financial Services Retail Customer Analytics Subscribe
Financial Services Retail Performance Analytics Subscribe
Financial Services Revenue Management And Billing Subscribe
Fusion Middleware Mapviewer Subscribe
Healthcare Foundation Subscribe
Healthcare Translational Research Subscribe
Hospitality Guest Access Subscribe
Hospitality Materials Control Subscribe
Hospitality Simphony Subscribe
Identity Manager Subscribe
Insurance Accounting Analyzer Subscribe
Insurance Allocation Manager For Enterprise Profitability Subscribe
Insurance Data Foundation Subscribe
Insurance Ifrs 17 Analyzer Subscribe
Insurance Insbridge Rating And Underwriting Subscribe
Insurance Performance Insight Subscribe
Jd Edwards Enterpriseone Tools Subscribe
Jdeveloper Subscribe
Jdeveloper And Adf Subscribe
Knowledge Subscribe
Peoplesoft Enterprise Peopletools Subscribe
Policy Automation Subscribe
Policy Automation Connector For Siebel Subscribe
Policy Automation For Mobile Devices Subscribe
Primavera Gateway Subscribe
Primavera Unifier Subscribe
Real-time Scheduler Subscribe
Rest Data Services Subscribe
Retail Back Office Subscribe
Retail Central Office Subscribe
Retail Customer Insights Subscribe
Retail Customer Management And Segmentation Foundation Subscribe
Retail Point-of-service Subscribe
Retail Returns Management Subscribe
Service Bus Subscribe
Siebel Mobile Applications Subscribe
Siebel Ui Framework Subscribe
Storagetek Tape Analytics Sw Tool Subscribe
System Utilities Subscribe
Tape Library Acsls Subscribe
Transportation Management Subscribe
Utilities Mobile Workforce Management Subscribe
Webcenter Sites Subscribe
Weblogic Server Subscribe
Cloudforms Subscribe
Cloudforms Managementengine Subscribe
Enterprise Linux Subscribe
Jboss Enterprise Application Platform Subscribe
Jboss Single Sign On Subscribe
Openshift Subscribe
Openstack Subscribe
Red Hat Single Sign On Subscribe
Rhev Manager Subscribe
Rhosemc Subscribe
Virtualization Manager Subscribe
Advisories
Source ID Title
Debian DLA Debian DLA DLA-1777-1 jquery security update
Debian DLA Debian DLA DLA-1797-1 drupal7 security update
Debian DLA Debian DLA DLA-2118-1 otrs2 security update
Debian DLA Debian DLA DLA-3551-1 otrs2 security update
Debian DSA Debian DSA DSA-4434-1 drupal7 security update
Debian DSA Debian DSA DSA-4460-1 mediawiki security update
Github GHSA Github GHSA GHSA-6c3j-c64m-qhgq XSS in jQuery as used in Drupal, Backdrop CMS, and other products
Ubuntu USN Ubuntu USN USN-7622-1 jQuery vulnerabilities
Fixes

Solution

No solution given by the vendor.


Workaround

No workaround given by the vendor.

References
Link Providers
http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00006.html cve-icon cve-icon
http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00025.html cve-icon cve-icon
http://packetstormsecurity.com/files/152787/dotCMS-5.1.1-Vulnerable-Dependencies.html cve-icon cve-icon
http://packetstormsecurity.com/files/153237/RetireJS-CORS-Issue-Script-Execution.html cve-icon cve-icon
http://packetstormsecurity.com/files/156743/OctoberCMS-Insecure-Dependencies.html cve-icon cve-icon
http://seclists.org/fulldisclosure/2019/May/10 cve-icon cve-icon
http://seclists.org/fulldisclosure/2019/May/11 cve-icon cve-icon
http://seclists.org/fulldisclosure/2019/May/13 cve-icon cve-icon
http://www.openwall.com/lists/oss-security/2019/06/03/2 cve-icon cve-icon
http://www.securityfocus.com/bid/108023 cve-icon cve-icon
https://access.redhat.com/errata/RHBA-2019:1570 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2019:1456 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2019:2587 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2019:3023 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2019:3024 cve-icon cve-icon
https://backdropcms.org/security/backdrop-sa-core-2019-009 cve-icon cve-icon
https://blog.jquery.com/2019/04/10/jquery-3-4-0-released/ cve-icon cve-icon cve-icon
https://github.com/jquery/jquery/commit/753d591aea698e57d6db58c9f722cd0808619b1b cve-icon cve-icon
https://github.com/jquery/jquery/pull/4333 cve-icon cve-icon
https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44601 cve-icon cve-icon
https://lists.apache.org/thread.html/08720ef215ee7ab3386c05a1a90a7d1c852bf0706f176a7816bf65fc%40%3Ccommits.airflow.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/5928aa293e39d248266472210c50f176cac1535220f2486e6a7fa844%40%3Ccommits.airflow.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/6097cdbd6f0a337bedd9bb5cc441b2d525ff002a96531de367e4259f%40%3Ccommits.airflow.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/88fb0362fd40e5b605ea8149f63241537b8b6fb5bfa315391fc5cbb7%40%3Ccommits.airflow.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/b736d0784cf02f5a30fbb4c5902762a15ad6d47e17e2c5a17b7d6205%40%3Ccommits.airflow.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/ba79cf1658741e9f146e4c59b50aee56656ea95d841d358d006c18b6%40%3Ccommits.roller.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/bcce5a9c532b386c68dab2f6b3ce8b0cc9b950ec551766e76391caa3%40%3Ccommits.nifi.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/r2041a75d3fc09dec55adfd95d598b38d22715303f65c997c054844c9%40%3Cissues.flink.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/r2baacab6e0acb5a2092eb46ae04fd6c3e8277b4fd79b1ffb7f3254fa%40%3Cissues.flink.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/r38f0d1aa3c923c22977fe7376508f030f22e22c1379fbb155bf29766%40%3Cdev.syncope.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/r41b5bfe009c845f67d4f68948cc9419ac2d62e287804aafd72892b08%40%3Cissues.flink.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/r7aac081cbddb6baa24b75e74abf0929bf309b176755a53e3ed810355%40%3Cdev.flink.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/r7d64895cc4dff84d0becfc572b20c0e4bf9bfa7b10c6f5f73e783734%40%3Cdev.storm.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/r7e8ebccb7c022e41295f6fdb7b971209b83702339f872ddd8cf8bf73%40%3Cissues.flink.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/rac25da84ecdcd36f6de5ad0d255f4e967209bbbebddb285e231da37d%40%3Cissues.flink.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b%40%3Ccommits.nifi.apache.org%3E cve-icon cve-icon
https://lists.debian.org/debian-lts-announce/2019/05/msg00006.html cve-icon cve-icon
https://lists.debian.org/debian-lts-announce/2019/05/msg00029.html cve-icon cve-icon
https://lists.debian.org/debian-lts-announce/2020/02/msg00024.html cve-icon cve-icon
https://lists.debian.org/debian-lts-announce/2023/08/msg00040.html cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4UOAZIFCSZ3ENEFOR5IXX6NFAD3HV7FA/ cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5IABSKTYZ5JUGL735UKGXL5YPRYOPUYI/ cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KYH3OAGR2RTCHRA5NOKX2TES7SNQMWGO/ cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QV3PKZC3PQCO3273HAT76PAQZFBEO4KP/ cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RLXRX23725JL366CNZGJZ7AQQB7LHQ6F/ cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WZW27UCJ5CYFL4KFFFMYMIBNMIU2ALG5/ cve-icon cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2019-11358 cve-icon
https://seclists.org/bugtraq/2019/Apr/32 cve-icon cve-icon
https://seclists.org/bugtraq/2019/Jun/12 cve-icon cve-icon
https://seclists.org/bugtraq/2019/May/18 cve-icon cve-icon
https://security.netapp.com/advisory/ntap-20190919-0001/ cve-icon cve-icon
https://snyk.io/vuln/SNYK-JS-JQUERY-174006 cve-icon cve-icon
https://supportportal.juniper.net/s/article/2021-07-Security-Bulletin-Junos-OS-Multiple-J-Web-vulnerabilities-resolved-in-Junos-OS-21-2R1 cve-icon cve-icon
https://www.cve.org/CVERecord?id=CVE-2019-11358 cve-icon
https://www.debian.org/security/2019/dsa-4434 cve-icon cve-icon
https://www.debian.org/security/2019/dsa-4460 cve-icon cve-icon
https://www.drupal.org/sa-core-2019-006 cve-icon cve-icon cve-icon
https://www.oracle.com//security-alerts/cpujul2021.html cve-icon cve-icon
https://www.oracle.com/security-alerts/cpuApr2021.html cve-icon cve-icon
https://www.oracle.com/security-alerts/cpuapr2020.html cve-icon cve-icon
https://www.oracle.com/security-alerts/cpujan2020.html cve-icon cve-icon
https://www.oracle.com/security-alerts/cpujan2021.html cve-icon cve-icon
https://www.oracle.com/security-alerts/cpujan2022.html cve-icon cve-icon
https://www.oracle.com/security-alerts/cpujul2020.html cve-icon cve-icon
https://www.oracle.com/security-alerts/cpuoct2020.html cve-icon cve-icon
https://www.oracle.com/security-alerts/cpuoct2021.html cve-icon cve-icon
https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html cve-icon cve-icon
https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html cve-icon cve-icon
https://www.privacy-wise.com/mitigating-cve-2019-11358-in-old-versions-of-jquery/ cve-icon cve-icon
https://www.synology.com/security/advisory/Synology_SA_19_19 cve-icon cve-icon
https://www.tenable.com/security/tns-2019-08 cve-icon cve-icon
https://www.tenable.com/security/tns-2020-02 cve-icon cve-icon
History

Fri, 11 Jul 2025 13:45:00 +0000

Type Values Removed Values Added
Metrics epss

{'score': 0.02394}

epss

{'score': 0.02777}


Fri, 15 Nov 2024 15:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}


Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published:

Updated: 2024-11-15T15:11:23.024Z

Reserved: 2019-04-19T00:00:00.000Z

Link: CVE-2019-11358

cve-icon Vulnrichment

Updated: 2024-08-04T22:48:09.199Z

cve-icon NVD

Status : Modified

Published: 2019-04-20T00:29:00.247

Modified: 2024-11-21T04:20:56.320

Link: CVE-2019-11358

cve-icon Redhat

Severity : Moderate

Publid Date: 2019-03-27T00:00:00Z

Links: CVE-2019-11358 - Bugzilla

cve-icon OpenCVE Enrichment

No data.

Weaknesses