⚠ Exploited in the wild
Exploitation observed in the wild. Not yet on CISA KEV.
CVE-2019-11358
Severity
6.1MEDIUM
EPSS
1.9%
top 16.98%
CISA KEV
Not in KEV
Exploit
Exploited in wild
Active exploitation observed
Affected products
Timeline
PublishedApr 20
Latest updateJul 8
Description
jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Object.prototype.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7
Affected Packages111 packages
Also affects: Debian Linux 10.0, 8.0, 9.0, Fedora 28, 29, 30
Patches
🔴Vulnerability Details
9💥Exploits & PoCs
1📋Vendor Advisories
13Oracle
▶
Oracle▶
Oracle Oracle Insurance Applications Risk Matrix: Framework Administrator IBFA (jQuery) — CVE-2019-11358↗2021-01-15
💬Community
24Bugzilla▶
CVE-2019-11358 atomic-openshift-web-console: js-jquery: Web console vulnerable to CVE-2019-11358 (moderate d impact) [openshift-enterprise-3.11.z]↗2020-01-29
Bugzilla▶
CVE-2019-11358 python-XStatic-jQuery: jquery: Prototype pollution in object's prototype leading to denial of service, remote code execution, or property injection [openstack-rdo]↗2019-07-11
Bugzilla▶
CVE-2019-11358 python-XStatic-jquery-ui: js-jquery: prototype pollution in object's prototype leading to denial of service or remote code execution or property injection [openstack-rdo]↗2019-07-11
Bugzilla▶
CVE-2019-11358 drupal7: js-jquery: prototype pollution in object's prototype leading to denial of service or remote code execution or property injection [epel-all]↗2019-04-24