CVE - CVE-2019-11358

CVE-ID
CVE-2019-11358	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Object.prototype.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
BID:108023 URL:http://www.securityfocus.com/bid/108023 BUGTRAQ:20190421 [SECURITY] [DSA 4434-1] drupal7 security update URL:https://seclists.org/bugtraq/2019/Apr/32 BUGTRAQ:20190509 dotCMS v5.1.1 Vulnerabilities URL:https://seclists.org/bugtraq/2019/May/18 BUGTRAQ:20190612 [SECURITY] [DSA 4460-1] mediawiki security update URL:https://seclists.org/bugtraq/2019/Jun/12 CONFIRM:https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44601 CONFIRM:https://security.netapp.com/advisory/ntap-20190919-0001/ CONFIRM:https://www.drupal.org/sa-core-2019-006 CONFIRM:https://www.synology.com/security/advisory/Synology_SA_19_19 CONFIRM:https://www.tenable.com/security/tns-2019-08 CONFIRM:https://www.tenable.com/security/tns-2020-02 CONFIRM:https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44601 URL:https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44601 CONFIRM:https://security.netapp.com/advisory/ntap-20190919-0001/ URL:https://security.netapp.com/advisory/ntap-20190919-0001/ CONFIRM:https://www.synology.com/security/advisory/Synology_SA_19_19 URL:https://www.synology.com/security/advisory/Synology_SA_19_19 CONFIRM:https://www.tenable.com/security/tns-2019-08 URL:https://www.tenable.com/security/tns-2019-08 CONFIRM:https://www.tenable.com/security/tns-2020-02 URL:https://www.tenable.com/security/tns-2020-02 DEBIAN:DSA-4434 URL:https://www.debian.org/security/2019/dsa-4434 DEBIAN:DSA-4460 URL:https://www.debian.org/security/2019/dsa-4460 FEDORA:FEDORA-2019-1a3edd7e8a URL:https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4UOAZIFCSZ3ENEFOR5IXX6NFAD3HV7FA/ FEDORA:FEDORA-2019-2a0ce0c58c URL:https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RLXRX23725JL366CNZGJZ7AQQB7LHQ6F/ FEDORA:FEDORA-2019-7eaf0bbe7c URL:https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KYH3OAGR2RTCHRA5NOKX2TES7SNQMWGO/ FEDORA:FEDORA-2019-a06dffab1c URL:https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QV3PKZC3PQCO3273HAT76PAQZFBEO4KP/ FEDORA:FEDORA-2019-eba8e44ee6 URL:https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5IABSKTYZ5JUGL735UKGXL5YPRYOPUYI/ FEDORA:FEDORA-2019-f563e66380 URL:https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WZW27UCJ5CYFL4KFFFMYMIBNMIU2ALG5/ FULLDISC:20190510 Re: dotCMS v5.1.1 HTML Injection & XSS Vulnerability URL:http://seclists.org/fulldisclosure/2019/May/13 FULLDISC:20190510 dotCMS v5.1.1 HTML Injection & XSS Vulnerability URL:http://seclists.org/fulldisclosure/2019/May/11 FULLDISC:20190510 dotCMS v5.1.1 Vulnerabilities URL:http://seclists.org/fulldisclosure/2019/May/10 MISC:http://packetstormsecurity.com/files/152787/dotCMS-5.1.1-Vulnerable-Dependencies.html MISC:http://packetstormsecurity.com/files/153237/RetireJS-CORS-Issue-Script-Execution.html MISC:http://packetstormsecurity.com/files/156743/OctoberCMS-Insecure-Dependencies.html MISC:https://supportportal.juniper.net/s/article/2021-07-Security-Bulletin-Junos-OS-Multiple-J-Web-vulnerabilities-resolved-in-Junos-OS-21-2R1 MISC:http://packetstormsecurity.com/files/152787/dotCMS-5.1.1-Vulnerable-Dependencies.html URL:http://packetstormsecurity.com/files/152787/dotCMS-5.1.1-Vulnerable-Dependencies.html MISC:http://packetstormsecurity.com/files/153237/RetireJS-CORS-Issue-Script-Execution.html URL:http://packetstormsecurity.com/files/153237/RetireJS-CORS-Issue-Script-Execution.html MISC:http://packetstormsecurity.com/files/156743/OctoberCMS-Insecure-Dependencies.html URL:http://packetstormsecurity.com/files/156743/OctoberCMS-Insecure-Dependencies.html MISC:https://backdropcms.org/security/backdrop-sa-core-2019-009 URL:https://backdropcms.org/security/backdrop-sa-core-2019-009 MISC:https://blog.jquery.com/2019/04/10/jquery-3-4-0-released/ URL:https://blog.jquery.com/2019/04/10/jquery-3-4-0-released/ MISC:https://github.com/jquery/jquery/commit/753d591aea698e57d6db58c9f722cd0808619b1b URL:https://github.com/jquery/jquery/commit/753d591aea698e57d6db58c9f722cd0808619b1b MISC:https://github.com/jquery/jquery/pull/4333 URL:https://github.com/jquery/jquery/pull/4333 MISC:https://snyk.io/vuln/SNYK-JS-JQUERY-174006 URL:https://snyk.io/vuln/SNYK-JS-JQUERY-174006 MISC:https://www.drupal.org/sa-core-2019-006 URL:https://www.drupal.org/sa-core-2019-006 MISC:https://www.oracle.com//security-alerts/cpujul2021.html URL:https://www.oracle.com//security-alerts/cpujul2021.html MISC:https://www.oracle.com/security-alerts/cpuApr2021.html URL:https://www.oracle.com/security-alerts/cpuApr2021.html MISC:https://www.oracle.com/security-alerts/cpuapr2020.html URL:https://www.oracle.com/security-alerts/cpuapr2020.html MISC:https://www.oracle.com/security-alerts/cpujan2020.html URL:https://www.oracle.com/security-alerts/cpujan2020.html MISC:https://www.oracle.com/security-alerts/cpujan2021.html URL:https://www.oracle.com/security-alerts/cpujan2021.html MISC:https://www.oracle.com/security-alerts/cpujan2022.html URL:https://www.oracle.com/security-alerts/cpujan2022.html MISC:https://www.oracle.com/security-alerts/cpujul2020.html URL:https://www.oracle.com/security-alerts/cpujul2020.html MISC:https://www.oracle.com/security-alerts/cpuoct2020.html URL:https://www.oracle.com/security-alerts/cpuoct2020.html MISC:https://www.oracle.com/security-alerts/cpuoct2021.html URL:https://www.oracle.com/security-alerts/cpuoct2021.html MISC:https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html URL:https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html MISC:https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html URL:https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html MISC:https://www.privacy-wise.com/mitigating-cve-2019-11358-in-old-versions-of-jquery/ URL:https://www.privacy-wise.com/mitigating-cve-2019-11358-in-old-versions-of-jquery/ MLIST:[airflow-commits] 20190428 [GitHub] [airflow] XD-DENG commented on issue #5197: [AIRFLOW-XXX] Fix CVE-2019-11358 URL:https://lists.apache.org/thread.html/6097cdbd6f0a337bedd9bb5cc441b2d525ff002a96531de367e4259f@%3Ccommits.airflow.apache.org%3E MLIST:[airflow-commits] 20190428 [GitHub] [airflow] XD-DENG merged pull request #5197: [AIRFLOW-XXX] Fix CVE-2019-11358 URL:https://lists.apache.org/thread.html/5928aa293e39d248266472210c50f176cac1535220f2486e6a7fa844@%3Ccommits.airflow.apache.org%3E MLIST:[airflow-commits] 20190428 [GitHub] [airflow] codecov-io commented on issue #5197: [AIRFLOW-XXX] Fix CVE-2019-11358 URL:https://lists.apache.org/thread.html/88fb0362fd40e5b605ea8149f63241537b8b6fb5bfa315391fc5cbb7@%3Ccommits.airflow.apache.org%3E MLIST:[airflow-commits] 20190428 [GitHub] [airflow] feng-tao commented on issue #5197: [AIRFLOW-XXX] Fix CVE-2019-11358 URL:https://lists.apache.org/thread.html/08720ef215ee7ab3386c05a1a90a7d1c852bf0706f176a7816bf65fc@%3Ccommits.airflow.apache.org%3E MLIST:[airflow-commits] 20190428 [GitHub] [airflow] feng-tao opened a new pull request #5197: [AIRFLOW-XXX] Fix CVE-2019-11358 URL:https://lists.apache.org/thread.html/b736d0784cf02f5a30fbb4c5902762a15ad6d47e17e2c5a17b7d6205@%3Ccommits.airflow.apache.org%3E MLIST:[debian-lts-announce] 20190506 [SECURITY] [DLA 1777-1] jquery security update URL:https://lists.debian.org/debian-lts-announce/2019/05/msg00006.html MLIST:[debian-lts-announce] 20190520 [SECURITY] [DLA 1797-1] drupal7 security update URL:https://lists.debian.org/debian-lts-announce/2019/05/msg00029.html MLIST:[debian-lts-announce] 20200224 [SECURITY] [DLA 2118-1] otrs2 security update URL:https://lists.debian.org/debian-lts-announce/2020/02/msg00024.html MLIST:[debian-lts-announce] 20230831 [SECURITY] [DLA 3551-1] otrs2 security update URL:https://lists.debian.org/debian-lts-announce/2023/08/msg00040.html MLIST:[drill-dev] 20191017 Dependencies used by Drill contain known vulnerabilities URL:https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442@%3Cdev.drill.apache.org%3E MLIST:[drill-dev] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities URL:https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f@%3Cdev.drill.apache.org%3E MLIST:[drill-issues] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities URL:https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc@%3Cissues.drill.apache.org%3E MLIST:[flink-dev] 20200513 [jira] [Created] (FLINK-17675) Resolve CVE-2019-11358 from jquery URL:https://lists.apache.org/thread.html/r7aac081cbddb6baa24b75e74abf0929bf309b176755a53e3ed810355@%3Cdev.flink.apache.org%3E MLIST:[flink-issues] 20200513 [jira] [Created] (FLINK-17675) Resolve CVE-2019-11358 from jquery URL:https://lists.apache.org/thread.html/rac25da84ecdcd36f6de5ad0d255f4e967209bbbebddb285e231da37d@%3Cissues.flink.apache.org%3E MLIST:[flink-issues] 20200518 [jira] [Assigned] (FLINK-17675) Resolve CVE-2019-11358 from jquery URL:https://lists.apache.org/thread.html/r41b5bfe009c845f67d4f68948cc9419ac2d62e287804aafd72892b08@%3Cissues.flink.apache.org%3E MLIST:[flink-issues] 20200518 [jira] [Commented] (FLINK-17675) Resolve CVE-2019-11358 from jquery URL:https://lists.apache.org/thread.html/r2041a75d3fc09dec55adfd95d598b38d22715303f65c997c054844c9@%3Cissues.flink.apache.org%3E MLIST:[flink-issues] 20200518 [jira] [Updated] (FLINK-17675) Resolve CVE-2019-11358 from jquery URL:https://lists.apache.org/thread.html/r7e8ebccb7c022e41295f6fdb7b971209b83702339f872ddd8cf8bf73@%3Cissues.flink.apache.org%3E MLIST:[flink-issues] 20200520 [jira] [Closed] (FLINK-17675) Resolve CVE-2019-11358 from jquery URL:https://lists.apache.org/thread.html/r2baacab6e0acb5a2092eb46ae04fd6c3e8277b4fd79b1ffb7f3254fa@%3Cissues.flink.apache.org%3E MLIST:[nifi-commits] 20191113 svn commit: r1869773 - /nifi/site/trunk/security.html URL:https://lists.apache.org/thread.html/bcce5a9c532b386c68dab2f6b3ce8b0cc9b950ec551766e76391caa3@%3Ccommits.nifi.apache.org%3E MLIST:[nifi-commits] 20200123 svn commit: r1873083 - /nifi/site/trunk/security.html URL:https://lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b@%3Ccommits.nifi.apache.org%3E MLIST:[oss-security] 20190603 Django: CVE-2019-12308 AdminURLFieldWidget XSS (plus patched bundled jQuery for CVE-2019-11358) URL:http://www.openwall.com/lists/oss-security/2019/06/03/2 MLIST:[roller-commits] 20190820 [jira] [Created] (ROL-2150) Fix Js security vulnerabilities detected using retire js URL:https://lists.apache.org/thread.html/ba79cf1658741e9f146e4c59b50aee56656ea95d841d358d006c18b6@%3Ccommits.roller.apache.org%3E MLIST:[storm-dev] 20200708 [GitHub] [storm] Crim opened a new pull request #3305: [STORM-3553] Upgrade jQuery from 1.11.1 to 3.5.1 URL:https://lists.apache.org/thread.html/r7d64895cc4dff84d0becfc572b20c0e4bf9bfa7b10c6f5f73e783734@%3Cdev.storm.apache.org%3E MLIST:[syncope-dev] 20200423 Jquery version on 2.1.x/2.0.x URL:https://lists.apache.org/thread.html/r38f0d1aa3c923c22977fe7376508f030f22e22c1379fbb155bf29766@%3Cdev.syncope.apache.org%3E REDHAT:RHBA-2019:1570 URL:https://access.redhat.com/errata/RHBA-2019:1570 REDHAT:RHSA-2019:1456 URL:https://access.redhat.com/errata/RHSA-2019:1456 REDHAT:RHSA-2019:2587 URL:https://access.redhat.com/errata/RHSA-2019:2587 REDHAT:RHSA-2019:3023 URL:https://access.redhat.com/errata/RHSA-2019:3023 REDHAT:RHSA-2019:3024 URL:https://access.redhat.com/errata/RHSA-2019:3024 SUSE:openSUSE-SU-2019:1839 URL:http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00006.html SUSE:openSUSE-SU-2019:1872 URL:http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00025.html
Assigning CNA
MITRE Corporation
Date Record Created
20190419	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20190419)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)