CVE-2019-11358
Summary
| CVE | CVE-2019-11358 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2019-04-20 00:29:00 UTC |
| Updated | 2023-11-07 03:02:00 UTC |
| Description | jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Object.prototype. |
Risk And Classification
Problem Types: CWE-1321
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Pony Mail! | MLIST | lists.apache.org | Mailing List, Third Party Advisory |
| [SECURITY] Fedora 30 Update: drupal8-8.6.15-1.fc30 - package-announce - Fedora Mailing-Lists | FEDORA | lists.fedoraproject.org | Third Party Advisory |
| [SECURITY] Fedora 30 Update: drupal7-7.66-1.fc30 - package-announce - Fedora Mailing-Lists | lists.fedoraproject.org | ||
| Red Hat Customer Portal | REDHAT | access.redhat.com | Third Party Advisory |
| [SECURITY] Fedora 30 Update: drupal8-8.6.15-1.fc30 - package-announce - Fedora Mailing-Lists | lists.fedoraproject.org | ||
| Pony Mail! | lists.apache.org | ||
| [SECURITY] [DLA 1777-1] jquery security update | MLIST | lists.debian.org | Mailing List, Third Party Advisory |
| Pony Mail! | MLIST | lists.apache.org | Mailing List, Third Party Advisory |
| Bugtraq: [SECURITY] [DSA 4460-1] mediawiki security update | BUGTRAQ | seclists.org | Issue Tracking, Mailing List, Third Party Advisory |
| dotCMS 5.1.1 Vulnerable Dependencies ≈ Packet Storm | MISC | packetstormsecurity.com | Third Party Advisory, VDB Entry |
| Pony Mail! | lists.apache.org | ||
| [SECURITY] [DLA 2118-1] otrs2 security update | MLIST | lists.debian.org | Mailing List, Third Party Advisory |
| Pony Mail! | MLIST | lists.apache.org | Mailing List, Third Party Advisory |
| Pony Mail! | MLIST | lists.apache.org | Mailing List, Third Party Advisory |
| Pony Mail! | MLIST | lists.apache.org | Mailing List, Third Party Advisory |
| Pony Mail! | lists.apache.org | ||
| Oracle Critical Patch Update Advisory - July 2020 | MISC | www.oracle.com | Third Party Advisory |
| [SECURITY] Fedora 28 Update: drupal8-8.6.15-1.fc28 - package-announce - Fedora Mailing-Lists | FEDORA | lists.fedoraproject.org | Third Party Advisory |
| Pony Mail! | MLIST | lists.apache.org | Mailing List, Third Party Advisory |
| Prototype Pollution in jquery | Snyk | MISC | snyk.io | Patch, Third Party Advisory |
| Pony Mail! | MLIST | lists.apache.org | Mailing List, Third Party Advisory |
| Pony Mail! | lists.apache.org | ||
| oss-security - Django: CVE-2019-12308 AdminURLFieldWidget XSS (plus patched bundled jQuery for CVE-2019-11358) | MLIST | www.openwall.com | Mailing List, Patch, Third Party Advisory |
| jQuery 3.4.0 Released | Official jQuery Blog | MISC | blog.jquery.com | Vendor Advisory |
| [SECURITY] Fedora 30 Update: drupal7-7.66-1.fc30 - package-announce - Fedora Mailing-Lists | FEDORA | lists.fedoraproject.org | Third Party Advisory |
| Pony Mail! | lists.apache.org | ||
| [security-announce] openSUSE-SU-2019:1839-1: moderate: Security update f | SUSE | lists.opensuse.org | Mailing List, Third Party Advisory |
| Pony Mail! | MLIST | lists.apache.org | Mailing List, Third Party Advisory |
| [SECURITY] Fedora 29 Update: drupal7-7.66-1.fc29 - package-announce - Fedora Mailing-Lists | lists.fedoraproject.org | ||
| [SECURITY] [DLA 1797-1] drupal7 security update | MLIST | lists.debian.org | Mailing List, Third Party Advisory |
| Pony Mail! | MLIST | lists.apache.org | Mailing List, Third Party Advisory |
| Core: Prevent Object.prototype pollution for $.extend( true, ... ) by mgol · Pull Request #4333 · jquery/jquery · GitHub | MISC | github.com | Patch, Third Party Advisory |
| Oracle Critical Patch Update Advisory - October 2020 | MISC | www.oracle.com | Third Party Advisory |
| Pony Mail! | MLIST | lists.apache.org | Mailing List, Third Party Advisory |
| Oracle Critical Patch Update Advisory - July 2021 | N/A | www.oracle.com | |
| Drupal core - Moderately critical - Cross Site Scripting - SA-CORE-2019-006 | Drupal.org | MISC | www.drupal.org | Patch, Third Party Advisory |
| Synology Inc. | CONFIRM | www.synology.com | Third Party Advisory |
| Full Disclosure: dotCMS v5.1.1 HTML Injection & XSS Vulnerability | FULLDISC | seclists.org | Mailing List, Patch, Third Party Advisory |
| Pony Mail! | MLIST | lists.apache.org | Mailing List, Third Party Advisory |
| RetireJS CORS Issue / Script Execution ≈ Packet Storm | MISC | packetstormsecurity.com | Third Party Advisory, VDB Entry |
| Core: Prevent Object.prototype pollution for $.extend( true, ... ) · jquery/jquery@753d591 · GitHub | MISC | github.com | Patch, Third Party Advisory |
| Pony Mail! | lists.apache.org | ||
| Oracle Critical Patch Update Advisory - October 2021 | MISC | www.oracle.com | |
| JQuery CVE-2019-11358 Cross Site Scripting Vulnerability | BID | www.securityfocus.com | Third Party Advisory, VDB Entry |
| [R1] Nessus Network Monitor 5.11.0 Fixes Multiple Third-party Vulnerabilities - Security Advisory | Tenable® | CONFIRM | www.tenable.com | Third Party Advisory |
| Pony Mail! | lists.apache.org | ||
| OctoberCMS Insecure Dependencies ≈ Packet Storm | MISC | packetstormsecurity.com | Third Party Advisory, VDB Entry |
| Public KB - SA44601 - 2020-10: Security Bulletin: Multiple Vulnerabilities Resolved in Pulse Connect Secure / Pulse Policy Secure / Pulse Secure Desktop Client 9.1R9 | CONFIRM | kb.pulsesecure.net | Third Party Advisory |
| [SECURITY] Fedora 28 Update: drupal7-7.66-1.fc28 - package-announce - Fedora Mailing-Lists | FEDORA | lists.fedoraproject.org | Third Party Advisory |
| Pony Mail! | lists.apache.org | ||
| Oracle Critical Patch Update Advisory - January 2022 | MISC | www.oracle.com | |
| Debian -- Security Information -- DSA-4434-1 drupal7 | DEBIAN | www.debian.org | Third Party Advisory |
| [R1] Tenable.sc 5.14.0 Fixes Multiple Vulnerabilities - Security Advisory | Tenable® | CONFIRM | www.tenable.com | Third Party Advisory |
| [SECURITY] [DLA 3551-1] otrs2 security update | MLIST | lists.debian.org | |
| Red Hat Customer Portal | REDHAT | access.redhat.com | Third Party Advisory |
| [SECURITY] Fedora 29 Update: drupal8-8.6.15-1.fc29 - package-announce - Fedora Mailing-Lists | lists.fedoraproject.org | ||
| [SECURITY] Fedora 28 Update: drupal8-8.6.15-1.fc28 - package-announce - Fedora Mailing-Lists | lists.fedoraproject.org | ||
| Pony Mail! | lists.apache.org | ||
| Full Disclosure: dotCMS v5.1.1 Vulnerabilities | FULLDISC | seclists.org | Mailing List, Third Party Advisory |
| CEC Juniper Community | MISC | supportportal.juniper.net | |
| Pony Mail! | lists.apache.org | ||
| Pony Mail! | MLIST | lists.apache.org | Mailing List, Third Party Advisory |
| Oracle Critical Patch Update - July 2019 | MISC | www.oracle.com | Third Party Advisory |
| Full Disclosure: Re: dotCMS v5.1.1 HTML Injection & XSS Vulnerability | FULLDISC | seclists.org | Mailing List, Patch, Third Party Advisory |
| Red Hat Customer Portal | REDHAT | access.redhat.com | Third Party Advisory |
| Pony Mail! | MLIST | lists.apache.org | Mailing List, Third Party Advisory |
| [SECURITY] Fedora 28 Update: drupal7-7.66-1.fc28 - package-announce - Fedora Mailing-Lists | lists.fedoraproject.org | ||
| Backdrop core - Moderately critical - Cross Site Scripting - SA-CORE-2019-009 | Backdrop CMS | MISC | backdropcms.org | Third Party Advisory |
| Pony Mail! | lists.apache.org | ||
| [SECURITY] Fedora 29 Update: drupal8-8.6.15-1.fc29 - package-announce - Fedora Mailing-Lists | FEDORA | lists.fedoraproject.org | Third Party Advisory |
| Pony Mail! | lists.apache.org | ||
| Red Hat Customer Portal | REDHAT | access.redhat.com | Third Party Advisory |
| Pony Mail! | MLIST | lists.apache.org | Mailing List, Third Party Advisory |
| Bugtraq: [SECURITY] [DSA 4434-1] drupal7 security update | BUGTRAQ | seclists.org | Issue Tracking, Mailing List, Third Party Advisory |
| Pony Mail! | lists.apache.org | ||
| Pony Mail! | MLIST | lists.apache.org | Mailing List, Third Party Advisory |
| Pony Mail! | MLIST | lists.apache.org | Mailing List, Third Party Advisory |
| Oracle Critical Patch Update - October 2019 | MISC | www.oracle.com | Third Party Advisory |
| Oracle Critical Patch Update Advisory - January 2020 | MISC | www.oracle.com | Third Party Advisory |
| Pony Mail! | lists.apache.org | ||
| Pony Mail! | lists.apache.org | ||
| Bugtraq: dotCMS v5.1.1 Vulnerabilities | BUGTRAQ | seclists.org | Issue Tracking, Mailing List, Patch, Third Party Advisory |
| Pony Mail! | lists.apache.org | ||
| Pony Mail! | MLIST | lists.apache.org | Mailing List, Third Party Advisory |
| Pony Mail! | lists.apache.org | ||
| Oracle Critical Patch Update Advisory - April 2020 | N/A | www.oracle.com | Third Party Advisory |
| Pony Mail! | lists.apache.org | ||
| Red Hat Customer Portal | REDHAT | access.redhat.com | Third Party Advisory |
| Mitigating CVE-2019-11358 in old versions of jQuery – PrivacyWise | MISC | www.privacy-wise.com | Patch, Third Party Advisory |
| [SECURITY] Fedora 29 Update: drupal7-7.66-1.fc29 - package-announce - Fedora Mailing-Lists | FEDORA | lists.fedoraproject.org | Third Party Advisory |
| Debian -- Security Information -- DSA-4460-1 mediawiki | DEBIAN | www.debian.org | Third Party Advisory |
| Pony Mail! | MLIST | lists.apache.org | Mailing List, Third Party Advisory |
| CVE-2019-11358 jQuery Vulnerability in NetApp Products | NetApp Product Security | CONFIRM | security.netapp.com | Third Party Advisory |
| Oracle Critical Patch Update Advisory - April 2021 | MISC | www.oracle.com | |
| [security-announce] openSUSE-SU-2019:1872-1: moderate: Security update f | SUSE | lists.opensuse.org | Mailing List, Third Party Advisory |
| Pony Mail! | MLIST | lists.apache.org | Mailing List, Third Party Advisory |
| Oracle Critical Patch Update Advisory - January 2021 | MISC | www.oracle.com | Third Party Advisory |
| Pony Mail! | lists.apache.org | ||
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 159652 Oracle Enterprise Linux Security Update for idm:dl1 and idm:client (ELSA-2020-4670)
- 159679 Oracle Enterprise Linux Security Update for pki-core:10.6 and pki-deps:10.6 (ELSA-2020-4847)
- 160196 Oracle Enterprise Linux Security Update for pcs (ELSA-2022-7343)
- 20288 Oracle Database 19c Critical OJVM Patch Update - October 2020
- 20297 Oracle Database 18c Critical OJVM Patch Update - October 2020
- 20313 Oracle Database 12.2.0.1 Critical OJVM Patch Update - October 2020
- 240808 Red Hat Update for pcs (RHSA-2022:7343)
- 241153 Red Hat Update for JBoss Enterprise Application Platform 7.4.9 (RHSA-2023:0554)
- 241154 Red Hat Update for JBoss Enterprise Application Platform 7.4.9 (RHSA-2023:0552)
- 241155 Red Hat Update for JBoss Enterprise Application Platform 7.4.9 (RHSA-2023:0553)
- 296073 Oracle Solaris 11.4 Support Repository Update (SRU) 24.75.2 Missing (CPUJUL2020)
- 354653 Amazon Linux Security Advisory for pcs : ALAS2-2023-1905
- 375425 Oracle BI Publisher Multiple Vulnerabilities(CPUOCT2020)
- 377492 Alibaba Cloud Linux Security Update for ipa (ALINUX2-SA-2020:0169)
- 377817 Alibaba Cloud Linux Security Update for pcs (ALINUX2-SA-2022:0056)
- 6000085 Debian Security Update for otrs2 (DLA 3551-1)
- 670245 EulerOS Security Update for pki-core (EulerOS-SA-2021-1831)
- 670927 EulerOS Security Update for pki-core (EulerOS-SA-2020-2560)
- 940071 AlmaLinux Security Update for idm:DL1 and idm:client (ALSA-2020:4670)
- 940348 AlmaLinux Security Update for pki-core:10.6 and pki-deps:10.6 (ALSA-2020:4847)
- 960340 Rocky Linux Security Update for idm:DL1 and idm:client (RLSA-2020:4670)
- 960454 Rocky Linux Security Update for pki-core:10.6 and pki-deps:10.6 (RLSA-2020:4847)
- 960746 Rocky Linux Security Update for pcs (RLSA-2021:4142)
- 980287 Nodejs (npm) Security Update for jquery (GHSA-6c3j-c64m-qhgq)
- 995283 Python (Pip) Security Update for django (GHSA-6c3j-c64m-qhgq)
- 995464 Java (Maven) Security Update for org.webjars.npm:jquery (GHSA-6c3j-c64m-qhgq)