JQuery CVE-2019-11358 Cross Site Scripting Vulnerability

Description

JQuery is prone to a cross-site-scripting vulnerability because it fails to sufficiently sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. JQuery versions prior to 3.4.0 are vulnerable.

Technologies Affected

• Backdrop Backdrop 1.11.0
• Backdrop Backdrop 1.11.1
• Backdrop Backdrop 1.11.2
• Backdrop Backdrop 1.11.3
• Backdrop Backdrop 1.11.4
• Backdrop Backdrop 1.11.5
• Backdrop Backdrop 1.11.6
• Backdrop Backdrop 1.11.7
• Backdrop Backdrop 1.11.8
• Backdrop Backdrop 1.12.0
• Backdrop Backdrop 1.12.1
• Backdrop Backdrop 1.12.2
• Backdrop Backdrop 1.12.3
• Backdrop Backdrop 1.12.4
• Backdrop Backdrop 1.12.5
• Drupal Drupal 7
• Drupal Drupal 7.0
• Drupal Drupal 7.10
• Drupal Drupal 7.11
• Drupal Drupal 7.12
• Drupal Drupal 7.13
• Drupal Drupal 7.14
• Drupal Drupal 7.15
• Drupal Drupal 7.16
• Drupal Drupal 7.17
• Drupal Drupal 7.19
• Drupal Drupal 7.20
• Drupal Drupal 7.21
• Drupal Drupal 7.22
• Drupal Drupal 7.23
• Drupal Drupal 7.24
• Drupal Drupal 7.25
• Drupal Drupal 7.26
• Drupal Drupal 7.27
• Drupal Drupal 7.28
• Drupal Drupal 7.29
• Drupal Drupal 7.30
• Drupal Drupal 7.31
• Drupal Drupal 7.32
• Drupal Drupal 7.33
• Drupal Drupal 7.34
• Drupal Drupal 7.35
• Drupal Drupal 7.36
• Drupal Drupal 7.37
• Drupal Drupal 7.38
• Drupal Drupal 7.39
• Drupal Drupal 7.4
• Drupal Drupal 7.40
• Drupal Drupal 7.41
• Drupal Drupal 7.42
• Drupal Drupal 7.44
• Drupal Drupal 7.5
• Drupal Drupal 7.52
• Drupal Drupal 7.54
• Drupal Drupal 7.55
• Drupal Drupal 7.56
• Drupal Drupal 7.57
• Drupal Drupal 7.58
• Drupal Drupal 7.59
• Drupal Drupal 7.62
• Drupal Drupal 7.65
• Drupal Drupal 7.8
• Drupal Drupal 7.9
• Drupal Drupal 8.5
• Drupal Drupal 8.5.0
• Drupal Drupal 8.5.1
• Drupal Drupal 8.5.11
• Drupal Drupal 8.5.14
• Drupal Drupal 8.5.2
• Drupal Drupal 8.5.3
• Drupal Drupal 8.5.6
• Drupal Drupal 8.5.7
• Drupal Drupal 8.5.8
• Drupal Drupal 8.5.9
• Drupal Drupal 8.6
• Drupal Drupal 8.6.1
• Drupal Drupal 8.6.10
• Drupal Drupal 8.6.13
• Drupal Drupal 8.6.2
• Drupal Drupal 8.6.3
• Drupal Drupal 8.6.4
• Drupal Drupal 8.6.5
• Drupal Drupal 8.6.6
• Oracle ADF 11.1.1.9.0
• Oracle ADF 12.1.3.0.0
• Oracle ADF 12.2.1.3.0
• Oracle Agile Product Lifecycle Management for Process 6.2.0.0
• Oracle Agile Product Lifecycle Management for Process 6.2.1.0
• Oracle Agile Product Lifecycle Management for Process 6.2.2.0
• Oracle Agile Product Lifecycle Management for Process 6.2.3.0
• Oracle Application Testing Suite 13.2
• Oracle Application Testing Suite 13.3
• Oracle Banking Platform 2.4.0
• Oracle Banking Platform 2.4.1
• Oracle Banking Platform 2.5
• Oracle Banking Platform 2.5.0
• Oracle Banking Platform 2.6
• Oracle Banking Platform 2.6.0
• Oracle Banking Platform 2.6.1
• Oracle Banking Platform 2.6.2
• Oracle Banking Platform 2.7.1
• Oracle Communications Billing and Revenue Management 12.0
• Oracle Communications Billing and Revenue Management 7.5
• Oracle Diagnostic Assistant 2.12.36
• Oracle Enterprise Manager Ops Center 12.3.3
• Oracle Enterprise Manager Ops Center 12.4.0
• Oracle Financial Services Analytical Applications Infrastructure 7.3.3
• Oracle Financial Services Analytical Applications Infrastructure 7.3.4
• Oracle Financial Services Analytical Applications Infrastructure 7.3.5
• Oracle Financial Services Analytical Applications Infrastructure 8.0.2
• Oracle Financial Services Analytical Applications Infrastructure 8.0.3
• Oracle Financial Services Analytical Applications Infrastructure 8.0.4
• Oracle Financial Services Analytical Applications Infrastructure 8.0.5
• Oracle Financial Services Analytical Applications Infrastructure 8.0.6
• Oracle Financial Services Analytical Applications Infrastructure 8.0.7
• Oracle Financial Services Analytical Applications Infrastructure 8.0.8
• Oracle Financial Services Analytical Applications Reconciliation Framew 8.0.4
• Oracle Financial Services Analytical Applications Reconciliation Framew 8.0.7
• Oracle Financial Services Asset Liability Management 8.0.4
• Oracle Financial Services Asset Liability Management 8.0.5
• Oracle Financial Services Asset Liability Management 8.0.7
• Oracle Financial Services Basel Regulatory Capital Basic 8.0.4
• Oracle Financial Services Basel Regulatory Capital Basic 8.0.7
• Oracle Financial Services Basel Regulatory Capital Internal Ratings Bas 8.0.4
• Oracle Financial Services Basel Regulatory Capital Internal Ratings Bas 8.0.7
• Oracle Financial Services Data Foundation 8.0.4
• Oracle Financial Services Data Foundation 8.0.5
• Oracle Financial Services Data Foundation 8.0.8
• Oracle Financial Services Data Integration Hub 8.0.5
• Oracle Financial Services Data Integration Hub 8.0.7
• Oracle Financial Services Enterprise Financial Performance Analytics 8.0.6
• Oracle Financial Services Enterprise Financial Performance Analytics 8.0.7
• Oracle Financial Services Funds Transfer Pricing 8.0.4
• Oracle Financial Services Funds Transfer Pricing 8.0.5
• Oracle Financial Services Funds Transfer Pricing 8.0.7
• Oracle Financial Services Hedge Management and IFRS Valuations 8.0.4
• Oracle Financial Services Hedge Management and IFRS Valuations 8.0.5
• Oracle Financial Services Hedge Management and IFRS Valuations 8.0.7
• Oracle Financial Services Institutional Performance Analytics 8.0.4
• Oracle Financial Services Institutional Performance Analytics 8.0.5
• Oracle Financial Services Institutional Performance Analytics 8.0.7
• Oracle Financial Services Liquidity Risk Management 8.0.1
• Oracle Financial Services Liquidity Risk Management 8.0.2
• Oracle Financial Services Liquidity Risk Management 8.0.4
• Oracle Financial Services Liquidity Risk Management 8.0.5
• Oracle Financial Services Liquidity Risk Management 8.0.6
• Oracle Financial Services Liquidity Risk Measurement and Management 8.0.7
• Oracle Financial Services Liquidity Risk Measurement and Management 8.0.8
• Oracle Financial Services Loan Loss Forecasting and Provisioning 8.0.2
• Oracle Financial Services Loan Loss Forecasting and Provisioning 8.0.3
• Oracle Financial Services Loan Loss Forecasting and Provisioning 8.0.4
• Oracle Financial Services Loan Loss Forecasting and Provisioning 8.0.5
• Oracle Financial Services Loan Loss Forecasting and Provisioning 8.0.7
• Oracle Financial Services Market Risk Measurement and Management 8.0.5
• Oracle Financial Services Market Risk Measurement and Management 8.0.6
• Oracle Financial Services Market Risk Measurement and Management 8.0.8
• Oracle Financial Services Price Creation and Discovery 8.0.4
• Oracle Financial Services Price Creation and Discovery 8.0.5
• Oracle Financial Services Price Creation and Discovery 8.0.7
• Oracle Financial Services Profitability Management 8.0.4
• Oracle Financial Services Profitability Management 8.0.5
• Oracle Financial Services Profitability Management 8.0.6
• Oracle Financial Services Profitability Management 8.0.7
• Oracle Financial Services Regulatory Reporting for European Banking Aut 8.0.6
• Oracle Financial Services Regulatory Reporting for European Banking Aut 8.0.7
• Oracle Financial Services Regulatory Reporting for US Federal Reserve 8.0.4
• Oracle Financial Services Regulatory Reporting for US Federal Reserve 8.0.7
• Oracle Financial Services Retail Customer Analytics 8.0.4
• Oracle Financial Services Retail Customer Analytics 8.0.5
• Oracle Financial Services Retail Customer Analytics 8.0.6
• Oracle Financial Services Retail Performance Analytics 8.0.6
• Oracle Financial Services Retail Performance Analytics 8.0.7
• Oracle Financial Services Revenue Management and Billing 2.4.0.0.0
• Oracle Financial Services Revenue Management and Billing 2.4.0.1
• Oracle Healthcare Foundation 7.1.1
• Oracle Healthcare Foundation 7.2.2
• Oracle Healthcare Translational Research 3.1.0
• Oracle Healthcare Translational Research 3.2.1
• Oracle Healthcare Translational Research 3.3.1
• Oracle Hospitality Guest Access 4.2.0
• Oracle Hospitality Guest Access 4.2.1
• Oracle Hospitality Materials Control 18.1
• Oracle Insurance Allocation Manager for Enterprise Profitability 8.0.8
• Oracle Insurance Data Foundation 8.0.4
• Oracle Insurance Data Foundation 8.0.5
• Oracle Insurance Data Foundation 8.0.7
• Oracle Insurance IFRS 17 Analyzer 8.0.6
• Oracle Insurance IFRS 17 Analyzer 8.0.7
• Oracle Insurance Performance Insight 8.0.7
• Oracle JDeveloper 11.1.1.9.0
• Oracle JDeveloper 12.1.3.0.0
• Oracle JDeveloper 12.2.1.3.0
• Oracle OFS REG REP EBA 8.0.6
• Oracle OFS REG REP EBA 8.0.7
• Oracle OFS REG REP RBI 8.0.7
• Oracle OFS REG REP US FED 8.0.4
• Oracle OFS REG REP US FED 8.0.7
• Oracle PeopleSoft Enterprise PeopleTools 8.55
• Oracle PeopleSoft Enterprise PeopleTools 8.56
• Oracle PeopleSoft Enterprise PeopleTools 8.57
• Oracle Policy Automation 10.4.7
• Oracle Policy Automation 12.1.0
• Oracle Policy Automation 12.1.1
• Oracle Policy Automation 12.2.0
• Oracle Policy Automation 12.2.1
• Oracle Policy Automation 12.2.10
• Oracle Policy Automation 12.2.15
• Oracle Policy Automation 12.2.2
• Oracle Policy Automation 12.2.3
• Oracle Policy Automation 12.2.7
• Oracle Policy Automation 12.2.8
• Oracle Policy Automation 12.2.9
• Oracle Policy Automation Connector for Siebel 10.4.6
• Oracle Policy Automation for Mobile Devices 12.2.0
• Oracle Policy Automation for Mobile Devices 12.2.10
• Oracle Policy Automation for Mobile Devices 12.2.15
• Oracle Policy Automation for Mobile Devices 12.2.4
• Oracle Policy Automation for Mobile Devices 12.2.5
• Oracle Policy Automation for Mobile Devices 12.2.6
• Oracle Policy Automation for Mobile Devices 12.2.7
• Oracle Policy Automation for Mobile Devices 12.2.8
• Oracle Policy Automation for Mobile Devices 12.2.9
• Oracle Primavera Unifier 16.1
• Oracle Primavera Unifier 16.2
• Oracle Primavera Unifier 17.12
• Oracle Primavera Unifier 17.7
• Oracle Primavera Unifier 18.8
• Oracle Retail Customer Insights 15.0
• Oracle Retail Customer Insights 16.0
• Oracle Service Bus 11.1.1.9.0
• Oracle Service Bus 12.1.3.0.0
• Oracle Service Bus 12.2.1.3.0
• Oracle Siebel Applications 19.0
• Oracle Siebel Applications 19.3
• Oracle Siebel Applications 19.8
• Oracle System Utilities 19.1
• Oracle Weblogic Server 10.3.6.0
• Oracle Weblogic Server 12.1.3.0.0
• Oracle Weblogic Server 12.2.1.3.0
• jQuery jQuery 1.0.0
• jQuery jQuery 1.0.1
• jQuery jQuery 1.10.0
• jQuery jQuery 1.6
• jQuery jQuery 1.6.1
• jQuery jQuery 1.6.2
• jQuery jQuery 1.6.3
• jQuery jQuery 1.6.4
• jQuery jQuery 1.7.1
• jQuery jQuery 1.8.1
• jQuery jQuery 1.9.0
• jQuery jQuery 2.2
• jQuery jQuery 3.0.0
• jQuery jQuery 3.1
• jQuery jQuery 3.1.0
• jQuery jQuery 3.1.1
• jQuery jQuery 3.2
• jQuery jQuery 3.2.0
• jQuery jQuery 3.2.1
• jQuery jQuery 3.3
• jQuery jQuery 3.3.0
• jQuery jQuery 3.3.1

Recommendations

Block external access at the network boundary, unless external parties require service.
Filter access to the affected computer at the network boundary if global access isn’t needed. Restricting access to only trusted computers and networks might greatly reduce the likelihood of a successful exploit.

Run all software as a nonprivileged user with minimal access rights.
Attackers may successfully exploit client flaws in the browser through cross-site scripting vulnerabilities. When possible, run all software as a user with minimal privileges and limited access to system resources. Use additional precautions such as restrictive environments to insulate software that may potentially handle malicious content.

Deploy network intrusion detection systems to monitor network traffic for malicious activity.
Deploy NIDS to detect and block attacks and anomalous activity such as requests containing suspicious URI sequences. Since the webserver may log such requests, review its logs regularly.

Do not follow links provided by unknown or untrusted sources.
Web users should be cautious about following links to sites that are provided by unfamiliar or suspicious sources. Filtering HTML from emails may help remove a possible vector for transmitting malicious links to users.

Set web browser security to disable the execution of script code or active content.
Since a successful exploit of this issue allows malicious code to execute in web clients, consider disabling support for script code and active content within the client browser. Note that this mitigation tactic might adversely affect legitimate websites that rely on the execution of browser-based script code.

Updates are available. Please see the references or vendor advisory for more information.