jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Object.prototype.
References
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
Configuration 3 (hide)
|
Configuration 4 (hide)
|
Configuration 5 (hide)
|
Configuration 6 (hide)
|
Configuration 7 (hide)
|
Configuration 8 (hide)
|
Configuration 9 (hide)
|
Configuration 10 (hide)
|
Configuration 11 (hide)
|
History
16 Feb 2024, 16:32
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* | |
| References | () https://lists.apache.org/thread.html/08720ef215ee7ab3386c05a1a90a7d1c852bf0706f176a7816bf65fc%40%3Ccommits.airflow.apache.org%3EÂ - Issue Tracking | |
| References | () https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3EÂ - Issue Tracking | |
| References | () https://lists.apache.org/thread.html/5928aa293e39d248266472210c50f176cac1535220f2486e6a7fa844%40%3Ccommits.airflow.apache.org%3EÂ - Issue Tracking | |
| References | () https://lists.apache.org/thread.html/6097cdbd6f0a337bedd9bb5cc441b2d525ff002a96531de367e4259f%40%3Ccommits.airflow.apache.org%3EÂ - Issue Tracking | |
| References | () https://lists.apache.org/thread.html/88fb0362fd40e5b605ea8149f63241537b8b6fb5bfa315391fc5cbb7%40%3Ccommits.airflow.apache.org%3EÂ - Issue Tracking | |
| References | () https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3EÂ - Issue Tracking | |
| References | () https://lists.apache.org/thread.html/b736d0784cf02f5a30fbb4c5902762a15ad6d47e17e2c5a17b7d6205%40%3Ccommits.airflow.apache.org%3EÂ - Issue Tracking | |
| References | () https://lists.apache.org/thread.html/ba79cf1658741e9f146e4c59b50aee56656ea95d841d358d006c18b6%40%3Ccommits.roller.apache.org%3EÂ - Issue Tracking | |
| References | () https://lists.apache.org/thread.html/bcce5a9c532b386c68dab2f6b3ce8b0cc9b950ec551766e76391caa3%40%3Ccommits.nifi.apache.org%3EÂ - Issue Tracking | |
| References | () https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3EÂ - Issue Tracking | |
| References | () https://lists.apache.org/thread.html/r2041a75d3fc09dec55adfd95d598b38d22715303f65c997c054844c9%40%3Cissues.flink.apache.org%3EÂ - Issue Tracking | |
| References | () https://lists.apache.org/thread.html/r2baacab6e0acb5a2092eb46ae04fd6c3e8277b4fd79b1ffb7f3254fa%40%3Cissues.flink.apache.org%3EÂ - Issue Tracking | |
| References | () https://lists.apache.org/thread.html/r38f0d1aa3c923c22977fe7376508f030f22e22c1379fbb155bf29766%40%3Cdev.syncope.apache.org%3EÂ - Issue Tracking | |
| References | () https://lists.apache.org/thread.html/r41b5bfe009c845f67d4f68948cc9419ac2d62e287804aafd72892b08%40%3Cissues.flink.apache.org%3EÂ - Issue Tracking | |
| References | () https://lists.apache.org/thread.html/r7aac081cbddb6baa24b75e74abf0929bf309b176755a53e3ed810355%40%3Cdev.flink.apache.org%3EÂ - Issue Tracking | |
| References | () https://lists.apache.org/thread.html/r7d64895cc4dff84d0becfc572b20c0e4bf9bfa7b10c6f5f73e783734%40%3Cdev.storm.apache.org%3EÂ - Issue Tracking | |
| References | () https://lists.apache.org/thread.html/r7e8ebccb7c022e41295f6fdb7b971209b83702339f872ddd8cf8bf73%40%3Cissues.flink.apache.org%3EÂ - Issue Tracking | |
| References | () https://lists.apache.org/thread.html/rac25da84ecdcd36f6de5ad0d255f4e967209bbbebddb285e231da37d%40%3Cissues.flink.apache.org%3EÂ - Issue Tracking | |
| References | () https://lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b%40%3Ccommits.nifi.apache.org%3EÂ - Issue Tracking | |
| References | () https://lists.debian.org/debian-lts-announce/2023/08/msg00040.html - Mailing List, Third Party Advisory | |
| References | () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4UOAZIFCSZ3ENEFOR5IXX6NFAD3HV7FA/Â - Mailing List, Third Party Advisory | |
| References | () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5IABSKTYZ5JUGL735UKGXL5YPRYOPUYI/Â - Mailing List, Third Party Advisory | |
| References | () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KYH3OAGR2RTCHRA5NOKX2TES7SNQMWGO/Â - Mailing List, Third Party Advisory | |
| References | () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QV3PKZC3PQCO3273HAT76PAQZFBEO4KP/Â - Mailing List, Third Party Advisory | |
| References | () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RLXRX23725JL366CNZGJZ7AQQB7LHQ6F/Â - Mailing List, Third Party Advisory | |
| References | () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WZW27UCJ5CYFL4KFFFMYMIBNMIU2ALG5/Â - Mailing List, Third Party Advisory | |
| References | () https://snyk.io/vuln/SNYK-JS-JQUERY-174006Â - Exploit, Third Party Advisory | |
| References | () https://www.oracle.com/security-alerts/cpujan2020.html - Patch, Third Party Advisory |
Information
Published : 2019-04-20 00:29
Updated : 2024-02-16 16:32
NVD link : CVE-2019-11358
Mitre link : CVE-2019-11358
CVE.ORG link : CVE-2019-11358
JSON object : View
Products Affected
oracle
- financial_services_analytical_applications_infrastructure
- financial_services_enterprise_financial_performance_analytics
- primavera_gateway
- knowledge
- communications_application_session_controller
- financial_services_regulatory_reporting_for_european_banking_authority
- financial_services_retail_performance_analytics
- weblogic_server
- jdeveloper_and_adf
- hospitality_simphony
- retail_central_office
- peoplesoft_enterprise_peopletools
- enterprise_session_border_controller
- application_testing_suite
- communications_unified_inventory_management
- utilities_mobile_workforce_management
- communications_analytics
- jdeveloper
- communications_billing_and_revenue_management
- insurance_ifrs_17_analyzer
- real-time_scheduler
- financial_services_funds_transfer_pricing
- insurance_insbridge_rating_and_underwriting
- communications_operations_monitor
- system_utilities
- financial_services_data_foundation
- financial_services_hedge_management_and_ifrs_valuations
- policy_automation
- primavera_unifier
- healthcare_translational_research
- agile_product_lifecycle_management_for_process
- communications_session_report_manager
- storagetek_tape_analytics_sw_tool
- siebel_mobile_applications
- financial_services_regulatory_reporting_for_us_federal_reserve
- rest_data_services
- financial_services_price_creation_and_discovery
- communications_element_manager
- banking_digital_experience
- financial_services_analytical_applications_reconciliation_framework
- banking_platform
- financial_services_revenue_management_and_billing
- financial_services_profitability_management
- jd_edwards_enterpriseone_tools
- policy_automation_connector_for_siebel
- financial_services_asset_liability_management
- communications_eagle_application_processor
- financial_services_data_integration_hub
- identity_manager
- webcenter_sites
- insurance_accounting_analyzer
- tape_library_acsls
- bi_publisher
- financial_services_basel_regulatory_capital_basic
- siebel_ui_framework
- financial_services_market_risk_measurement_and_management
- retail_customer_management_and_segmentation_foundation
- communications_webrtc_session_controller
- fusion_middleware_mapviewer
- enterprise_manager_ops_center
- retail_customer_insights
- financial_services_balance_sheet_planning
- retail_point-of-service
- communications_diameter_signaling_router
- healthcare_foundation
- banking_enterprise_collections
- service_bus
- policy_automation_for_mobile_devices
- financial_services_liquidity_risk_measurement_and_management
- diagnostic_assistant
- transportation_management
- financial_services_loan_loss_forecasting_and_provisioning
- application_service_level_management
- financial_services_basel_regulatory_capital_internal_ratings_based_approach
- hospitality_guest_access
- financial_services_liquidity_risk_management
- communications_session_route_manager
- insurance_performance_insight
- financial_services_retail_customer_analytics
- retail_returns_management
- financial_services_regulatory_reporting_for_de_nederlandsche_bank
- financial_services_institutional_performance_analytics
- retail_back_office
- insurance_data_foundation
- financial_services_data_governance_for_us_regulatory_reporting
- communications_services_gatekeeper
- communications_interactive_session_recorder
- hospitality_materials_control
- business_process_management_suite
- insurance_allocation_manager_for_enterprise_profitability
- application_express
- big_data_discovery
netapp
- snapcenter
- oncommand_system_manager
jquery
- jquery
debian
- debian_linux
opensuse
- leap
- backports_sle
drupal
- drupal
fedoraproject
- fedora
redhat
- virtualization_manager
- cloudforms
juniper
- junos
joomla
- joomla\!
backdropcms
- backdrop
CWE
CWE-1321
Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
