Lucene search

MitreCVE-2019-11358

HistoryApr 20, 2019 - 12:29 a.m.

CVE-2019-11358

2019-04-2000:29:00

CWE-1321

mitre

web.nvd.nist.gov

1371

In Wild

jquery

cve

object.prototype

drupal

backdrop cms

nvd

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

AI Score

6.4

Confidence

High

EPSS

0.024

Percentile

90.2%

JSON

jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, …) because of Object.prototype pollution. If an unsanitized source object contained an enumerable proto property, it could extend the native Object.prototype.

Affected configurations

Nvd

Node

jqueryjqueryRange<3.4.0

Node

debiandebian_linuxMatch8.0

debiandebian_linuxMatch9.0

debiandebian_linuxMatch10.0

Node

drupaldrupalRange7.0–7.66

drupaldrupalRange8.5.0–8.5.15

drupaldrupalRange8.6.0–8.6.15

Node

backdropcmsbackdropRange1.11.0–1.11.9

backdropcmsbackdropRange1.12.0–1.12.6

Node

fedoraprojectfedoraMatch28

fedoraprojectfedoraMatch29

fedoraprojectfedoraMatch30

Node

opensusebackports_sleMatch15.0sp1

opensuseleapMatch15.1

Node

netapponcommand_system_managerRange3.0–3.1.3

netappsnapcenterMatch-

Node

redhatcloudformsMatch4.7

redhatvirtualization_managerMatch4.3

Node

oracleagile_product_lifecycle_management_for_processMatch6.1

oracleagile_product_lifecycle_management_for_processMatch6.2.0.0

oracleagile_product_lifecycle_management_for_processMatch6.2.1.0

oracleagile_product_lifecycle_management_for_processMatch6.2.2.0

oracleagile_product_lifecycle_management_for_processMatch6.2.3.0

oracleapplication_expressRange<19.1

oracleapplication_service_level_managementMatch13.2.0.0

oracleapplication_service_level_managementMatch13.3.0.0

oracleapplication_testing_suiteMatch12.5.0.3

oracleapplication_testing_suiteMatch13.1.0.1

oracleapplication_testing_suiteMatch13.2

oracleapplication_testing_suiteMatch13.2.0.1

oracleapplication_testing_suiteMatch13.3

oracleapplication_testing_suiteMatch13.3.0.1

oraclebanking_digital_experienceMatch18.1

oraclebanking_digital_experienceMatch18.2

oraclebanking_digital_experienceMatch18.3

oraclebanking_digital_experienceMatch19.1

oraclebanking_digital_experienceMatch19.2

oraclebanking_digital_experienceMatch20.1

oraclebanking_enterprise_collectionsRange2.7.0–2.8.0

oraclebanking_platformRange2.4.0–2.10.0

oraclebi_publisherMatch5.5.0.0.0

oraclebi_publisherMatch12.2.1.3.0

oraclebi_publisherMatch12.2.1.4.0

oraclebig_data_discoveryMatch1.6

oraclebusiness_process_management_suiteMatch12.2.1.3.0

oraclebusiness_process_management_suiteMatch12.2.1.4.0

oraclecommunications_analyticsMatch12.1.1

oraclecommunications_application_session_controllerMatch3.8m0

oraclecommunications_billing_and_revenue_managementMatch7.5

oraclecommunications_billing_and_revenue_managementMatch7.5.0.23.0

oraclecommunications_billing_and_revenue_managementMatch12.0

oraclecommunications_billing_and_revenue_managementMatch12.0.0.3.0

oraclecommunications_diameter_signaling_routerMatch8.0.0

oraclecommunications_diameter_signaling_routerMatch8.1

oraclecommunications_diameter_signaling_routerMatch8.2

oraclecommunications_diameter_signaling_routerMatch8.2.1

oraclecommunications_eagle_application_processorRange16.1.0–16.4.0

oraclecommunications_element_managerMatch8.1.1

oraclecommunications_element_managerMatch8.2.0

oraclecommunications_element_managerMatch8.2.1

oraclecommunications_interactive_session_recorderRange6.0–6.4

oraclecommunications_operations_monitorRange4.1–4.3

oraclecommunications_operations_monitorMatch3.4

oraclecommunications_operations_monitorMatch4.0

oraclecommunications_operations_monitorMatch4.1.0

oraclecommunications_services_gatekeeperMatch7.0

oraclecommunications_session_report_managerMatch8.1.1

oraclecommunications_session_report_managerMatch8.2.0

oraclecommunications_session_report_managerMatch8.2.1

oraclecommunications_session_route_managerMatch8.1.1

oraclecommunications_session_route_managerMatch8.2.0

oraclecommunications_session_route_managerMatch8.2.1

oraclecommunications_unified_inventory_managementMatch7.3

oraclecommunications_unified_inventory_managementMatch7.4.0

oraclecommunications_webrtc_session_controllerMatch7.2

oraclediagnostic_assistantMatch2.12.36

oracleenterprise_manager_ops_centerMatch12.3.3

oracleenterprise_manager_ops_centerMatch12.4.0

oracleenterprise_manager_ops_centerMatch12.4.0.0

oracleenterprise_session_border_controllerMatch8.4

oraclefinancial_services_analytical_applications_infrastructureRange7.3.3–7.3.5

oraclefinancial_services_analytical_applications_infrastructureRange8.0.2–8.1.0

oraclefinancial_services_analytical_applications_reconciliation_frameworkRange8.0.4–8.0.7

oraclefinancial_services_analytical_applications_reconciliation_frameworkMatch8.1.0

oraclefinancial_services_asset_liability_managementRange8.0.4–8.0.7

oraclefinancial_services_asset_liability_managementMatch8.1.0

oraclefinancial_services_balance_sheet_planningMatch8.0.8

oraclefinancial_services_basel_regulatory_capital_basicRange8.0.4–8.0.7

oraclefinancial_services_basel_regulatory_capital_basicMatch8.1.0

oraclefinancial_services_basel_regulatory_capital_internal_ratings_based_approachRange8.0.4–8.0.7

oraclefinancial_services_basel_regulatory_capital_internal_ratings_based_approachMatch8.1.0

oraclefinancial_services_data_foundationRange8.0.4–8.0.8

oraclefinancial_services_data_governance_for_us_regulatory_reportingRange8.0.6–8.0.9

oraclefinancial_services_data_integration_hubRange8.0.5–8.0.7

oraclefinancial_services_data_integration_hubMatch8.1.0

oraclefinancial_services_enterprise_financial_performance_analyticsMatch8.0.6

oraclefinancial_services_enterprise_financial_performance_analyticsMatch8.0.7

oraclefinancial_services_funds_transfer_pricingRange8.0.4–8.0.7

oraclefinancial_services_funds_transfer_pricingMatch8.1.0

oraclefinancial_services_hedge_management_and_ifrs_valuationsRange8.0.4–8.0.7

oraclefinancial_services_hedge_management_and_ifrs_valuationsMatch8.1.0

oraclefinancial_services_institutional_performance_analyticsRange8.0.4–8.0.7

oraclefinancial_services_institutional_performance_analyticsMatch8.1.0

oraclefinancial_services_liquidity_risk_managementMatch8.0.0.1.0

oraclefinancial_services_liquidity_risk_managementMatch8.0.2

oraclefinancial_services_liquidity_risk_managementMatch8.0.4.0.0

oraclefinancial_services_liquidity_risk_managementMatch8.0.5.0.0

oraclefinancial_services_liquidity_risk_managementMatch8.0.6

oraclefinancial_services_liquidity_risk_measurement_and_managementMatch8.0.7

oraclefinancial_services_liquidity_risk_measurement_and_managementMatch8.0.8

oraclefinancial_services_liquidity_risk_measurement_and_managementMatch8.1.0

oraclefinancial_services_loan_loss_forecasting_and_provisioningRange8.0.2–8.0.7

oraclefinancial_services_loan_loss_forecasting_and_provisioningMatch8.1.0

oraclefinancial_services_market_risk_measurement_and_managementMatch8.0.5

oraclefinancial_services_market_risk_measurement_and_managementMatch8.0.6

oraclefinancial_services_market_risk_measurement_and_managementMatch8.0.8

oraclefinancial_services_price_creation_and_discoveryRange8.0.4–8.0.7

oraclefinancial_services_profitability_managementRange8.0.4–8.0.7

oraclefinancial_services_profitability_managementMatch8.1.0

oraclefinancial_services_regulatory_reporting_for_de_nederlandsche_bankMatch8.0.4

oraclefinancial_services_regulatory_reporting_for_european_banking_authorityMatch8.0.6

oraclefinancial_services_regulatory_reporting_for_european_banking_authorityMatch8.0.7

oraclefinancial_services_regulatory_reporting_for_us_federal_reserveRange8.0.4–8.0.7

oraclefinancial_services_retail_customer_analyticsRange8.0.4–8.0.6

oraclefinancial_services_retail_performance_analyticsMatch8.0.6

oraclefinancial_services_retail_performance_analyticsMatch8.0.7

oraclefinancial_services_revenue_management_and_billingMatch2.4.0.0

oraclefinancial_services_revenue_management_and_billingMatch2.4.0.1

oraclefusion_middleware_mapviewerMatch12.2.1.3.0

oraclehealthcare_foundationMatch7.1.1

oraclehealthcare_foundationMatch7.2.0

oraclehealthcare_foundationMatch7.2.2

oraclehealthcare_foundationMatch7.3.0

oraclehealthcare_translational_researchMatch3.1.0

oraclehealthcare_translational_researchMatch3.2.1

oraclehealthcare_translational_researchMatch3.3.1

oraclehealthcare_translational_researchMatch3.3.2

oraclehealthcare_translational_researchMatch3.4.0

oraclehospitality_guest_accessMatch4.2.0

oraclehospitality_guest_accessMatch4.2.1

oraclehospitality_materials_controlMatch18.1

oraclehospitality_simphonyRange19.1.0–19.1.2

oraclehospitality_simphonyMatch18.1

oraclehospitality_simphonyMatch18.2

oracleidentity_managerMatch12.2.1.3.0

oracleinsurance_accounting_analyzerMatch8.0.9

oracleinsurance_allocation_manager_for_enterprise_profitabilityMatch8.0.8

oracleinsurance_allocation_manager_for_enterprise_profitabilityMatch8.1.0

oracleinsurance_data_foundationRange8.0.4–8.0.7

oracleinsurance_ifrs_17_analyzerMatch8.0.6

oracleinsurance_ifrs_17_analyzerMatch8.0.7

oracleinsurance_insbridge_rating_and_underwritingRange5.0.0.0–5.6.0.0

oracleinsurance_insbridge_rating_and_underwritingMatch5.6.1.0

oracleinsurance_performance_insightMatch8.0.7

oraclejd_edwards_enterpriseone_toolsMatch9.2

oraclejdeveloperMatch11.1.1.9.0

oraclejdeveloperMatch12.2.1.3.0

oraclejdeveloperMatch12.2.1.4.0

oraclejdeveloper_and_adfMatch11.1.1.9.0

oraclejdeveloper_and_adfMatch12.1.3.0.0

oraclejdeveloper_and_adfMatch12.2.1.3.0

oracleknowledgeRange8.6.0–8.6.3

oraclepeoplesoft_enterprise_peopletoolsMatch8.55

oraclepeoplesoft_enterprise_peopletoolsMatch8.56

oraclepeoplesoft_enterprise_peopletoolsMatch8.57

oraclepeoplesoft_enterprise_peopletoolsMatch8.58

oraclepolicy_automationRange12.2.0–12.2.15

oraclepolicy_automationMatch10.4.7

oraclepolicy_automationMatch12.1.0

oraclepolicy_automationMatch12.1.1

oraclepolicy_automation_connector_for_siebelMatch10.4.6

oraclepolicy_automation_for_mobile_devicesRange12.2.0–12.2.15

oracleprimavera_gatewayRange16.2.0–16.2.11

oracleprimavera_gatewayRange17.12.0–17.12.7

oracleprimavera_gatewayRange18.8.0–18.8.9

oracleprimavera_gatewayRange19.12.0–19.12.4

oracleprimavera_gatewayMatch15.2.18

oracleprimavera_unifierRange17.7–17.12

oracleprimavera_unifierMatch16.1

oracleprimavera_unifierMatch16.2

oracleprimavera_unifierMatch18.8

oraclereal-time_schedulerRange2.3.0.1–2.3.0.3

oraclerest_data_servicesMatch11.2.0.4-

oraclerest_data_servicesMatch12.1.0.2-

oraclerest_data_servicesMatch12.2.0.1-

oraclerest_data_servicesMatch18c-

oraclerest_data_servicesMatch19c-

oracleretail_back_officeMatch14.0

oracleretail_back_officeMatch14.1

oracleretail_central_officeMatch14.0

oracleretail_central_officeMatch14.1

oracleretail_customer_insightsMatch15.0

oracleretail_customer_insightsMatch16.0

oracleretail_customer_management_and_segmentation_foundationMatch18.0

oracleretail_customer_management_and_segmentation_foundationMatch19.0

oracleretail_point-of-serviceMatch14.0

oracleretail_point-of-serviceMatch14.1

oracleretail_returns_managementMatch14.0

oracleretail_returns_managementMatch14.1

oracleservice_busMatch11.1.1.9.0

oracleservice_busMatch12.1.3.0.0

oracleservice_busMatch12.2.1.3.0

oraclesiebel_mobile_applicationsRange≤19.8

oraclesiebel_ui_frameworkMatch20.8

oraclestoragetek_tape_analytics_sw_toolMatch2.3.0

oraclesystem_utilitiesMatch19.1

oracletape_library_acslsMatch8.5

oracletape_library_acslsMatch8.5.1

oracletransportation_managementMatch1.4.3

oracleutilities_mobile_workforce_managementRange2.3.0.1–2.3.0.3

oraclewebcenter_sitesMatch12.2.1.3.0

oracleweblogic_serverMatch10.3.6.0.0

oracleweblogic_serverMatch12.1.3.0.0

oracleweblogic_serverMatch12.2.1.3.0

oracleweblogic_serverMatch12.2.1.4.0

oracleweblogic_serverMatch14.1.1.0.0

Node

joomlajoomla\!Range3.0.0–3.9.4

Node

juniperjunosMatch21.2-

References

lists.opensuse.org/opensuse-security-announce/2019-08/msg00006.html

lists.opensuse.org/opensuse-security-announce/2019-08/msg00025.html

packetstormsecurity.com/files/152787/dotCMS-5.1.1-Vulnerable-Dependencies.html

packetstormsecurity.com/files/153237/RetireJS-CORS-Issue-Script-Execution.html

packetstormsecurity.com/files/156743/OctoberCMS-Insecure-Dependencies.html

seclists.org/fulldisclosure/2019/May/10

seclists.org/fulldisclosure/2019/May/11

seclists.org/fulldisclosure/2019/May/13

www.openwall.com/lists/oss-security/2019/06/03/2

www.securityfocus.com/bid/108023

access.redhat.com/errata/RHBA-2019:1570

access.redhat.com/errata/RHSA-2019:1456

access.redhat.com/errata/RHSA-2019:2587

access.redhat.com/errata/RHSA-2019:3023

access.redhat.com/errata/RHSA-2019:3024

backdropcms.org/security/backdrop-sa-core-2019-009

blog.jquery.com/2019/04/10/jquery-3-4-0-released/

github.com/jquery/jquery/commit/753d591aea698e57d6db58c9f722cd0808619b1b

github.com/jquery/jquery/pull/4333

kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44601

lists.apache.org/thread.html/08720ef215ee7ab3386c05a1a90a7d1c852bf0706f176a7816bf65fc%40%3Ccommits.airflow.apache.org%3E

lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E

lists.apache.org/thread.html/5928aa293e39d248266472210c50f176cac1535220f2486e6a7fa844%40%3Ccommits.airflow.apache.org%3E

lists.apache.org/thread.html/6097cdbd6f0a337bedd9bb5cc441b2d525ff002a96531de367e4259f%40%3Ccommits.airflow.apache.org%3E

lists.apache.org/thread.html/88fb0362fd40e5b605ea8149f63241537b8b6fb5bfa315391fc5cbb7%40%3Ccommits.airflow.apache.org%3E

lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E

lists.apache.org/thread.html/b736d0784cf02f5a30fbb4c5902762a15ad6d47e17e2c5a17b7d6205%40%3Ccommits.airflow.apache.org%3E

lists.apache.org/thread.html/ba79cf1658741e9f146e4c59b50aee56656ea95d841d358d006c18b6%40%3Ccommits.roller.apache.org%3E

lists.apache.org/thread.html/bcce5a9c532b386c68dab2f6b3ce8b0cc9b950ec551766e76391caa3%40%3Ccommits.nifi.apache.org%3E

lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E

lists.apache.org/thread.html/r2041a75d3fc09dec55adfd95d598b38d22715303f65c997c054844c9%40%3Cissues.flink.apache.org%3E

lists.apache.org/thread.html/r2baacab6e0acb5a2092eb46ae04fd6c3e8277b4fd79b1ffb7f3254fa%40%3Cissues.flink.apache.org%3E

lists.apache.org/thread.html/r38f0d1aa3c923c22977fe7376508f030f22e22c1379fbb155bf29766%40%3Cdev.syncope.apache.org%3E

lists.apache.org/thread.html/r41b5bfe009c845f67d4f68948cc9419ac2d62e287804aafd72892b08%40%3Cissues.flink.apache.org%3E

lists.apache.org/thread.html/r7aac081cbddb6baa24b75e74abf0929bf309b176755a53e3ed810355%40%3Cdev.flink.apache.org%3E

lists.apache.org/thread.html/r7d64895cc4dff84d0becfc572b20c0e4bf9bfa7b10c6f5f73e783734%40%3Cdev.storm.apache.org%3E

lists.apache.org/thread.html/r7e8ebccb7c022e41295f6fdb7b971209b83702339f872ddd8cf8bf73%40%3Cissues.flink.apache.org%3E

lists.apache.org/thread.html/rac25da84ecdcd36f6de5ad0d255f4e967209bbbebddb285e231da37d%40%3Cissues.flink.apache.org%3E

lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b%40%3Ccommits.nifi.apache.org%3E

lists.debian.org/debian-lts-announce/2019/05/msg00006.html

lists.debian.org/debian-lts-announce/2019/05/msg00029.html

lists.debian.org/debian-lts-announce/2020/02/msg00024.html

lists.debian.org/debian-lts-announce/2023/08/msg00040.html

lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4UOAZIFCSZ3ENEFOR5IXX6NFAD3HV7FA/

lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5IABSKTYZ5JUGL735UKGXL5YPRYOPUYI/

lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KYH3OAGR2RTCHRA5NOKX2TES7SNQMWGO/

lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QV3PKZC3PQCO3273HAT76PAQZFBEO4KP/

lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RLXRX23725JL366CNZGJZ7AQQB7LHQ6F/

lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WZW27UCJ5CYFL4KFFFMYMIBNMIU2ALG5/

seclists.org/bugtraq/2019/Apr/32

seclists.org/bugtraq/2019/Jun/12

seclists.org/bugtraq/2019/May/18

security.netapp.com/advisory/ntap-20190919-0001/

snyk.io/vuln/SNYK-JS-JQUERY-174006

supportportal.juniper.net/s/article/2021-07-Security-Bulletin-Junos-OS-Multiple-J-Web-vulnerabilities-resolved-in-Junos-OS-21-2R1

www.debian.org/security/2019/dsa-4434

www.debian.org/security/2019/dsa-4460

www.drupal.org/sa-core-2019-006

www.oracle.com//security-alerts/cpujul2021.html

www.oracle.com/security-alerts/cpuapr2020.html

www.oracle.com/security-alerts/cpuApr2021.html

www.oracle.com/security-alerts/cpujan2020.html

www.oracle.com/security-alerts/cpujan2021.html

www.oracle.com/security-alerts/cpujan2022.html

www.oracle.com/security-alerts/cpujul2020.html

www.oracle.com/security-alerts/cpuoct2020.html

www.oracle.com/security-alerts/cpuoct2021.html

www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html

www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html

www.privacy-wise.com/mitigating-cve-2019-11358-in-old-versions-of-jquery/

www.synology.com/security/advisory/Synology_SA_19_19

www.tenable.com/security/tns-2019-08

www.tenable.com/security/tns-2020-02

Social References

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

AI Score

6.4

Confidence

High

EPSS

0.024

Percentile

90.2%

JSON

CVE-2019-11358

Affected configurations

References

Social References

Related