01 Record

CVE-2019-11358

jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an

UnratedPUBLISHEDCNA: mitre

CNA base scoreUnratedNo CNA CVSS vector

View raw JSON

02 Description

jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an

03 Exploitation and scoring

Exploitation

Assessed, none found. CISA's assessment recorded neither public exploit code nor evidence of exploitation when it was made.

SSVC decision

ExploitationnoneCISA recorded no public exploit code and no evidence of exploitation.
AutomatablenoAt least one step from reconnaissance to exploitation cannot be reliably automated.
Technical ImpactpartialSuccessful exploitation gives limited control of the vulnerable component.

CISA publishes the decision points, not a final SSVC decision. The decision also depends on mission and well-being impact, which is a property of your deployment rather than of the vulnerability.

EPSS probability

86.82% probability of exploitation activity in the next 30 days.

EPSS percentile

Equal to or higher than the score of 99.7% of scored records. A rank, not a probability.

NVD base score

6.1 (CVSS v3.x), scored by the NVD independently of the CNA.

NVD CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

NVD analysis status

Modified. NVD last modified this record on 2026-06-17.

Red Hat severity

Moderate. Red Hat's rating for its own products, not a CVSS rating.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

04 Metadata

Published

2019-04-19 00:00Z7 YR AGO

Last updated

2024-11-15 15:11Z1 YR AGO

Reserved

2019-04-19

Assigning CNA

mitre

Record state

PUBLISHED

Severity

Not rated by the issuing CNA

CNA CVSS vector

Not published by the issuing CNA

Weaknesses

CWE-1321Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')Variant
CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')Base

Data version

5.1

Document digest

9f6cbad1600bc5208cee273ecbc9f32485d7a80848ab8a5d2b8204b23626d25c

05 Affected products

VendorProductVersionsPlatforms

backdropcmsbackdropNot specified—

debiandebian_linuxNot specified—

drupaldrupalNot specified—

fedoraprojectfedoraNot specified—

joomlajoomla!Not specified—

jqueryjqueryNot specified—

juniperjunosNot specified—

netapponcommand_system_managerNot specified—

netappsnapcenterNot specified—

opensusebackports_sleNot specified—

opensuseleapNot specified—

oracleagile_product_lifecycle_management_for_processNot specified—

oracleapplication_expressNot specified—

oracleapplication_service_level_managementNot specified—

oracleapplication_testing_suiteNot specified—

oraclebanking_digital_experienceNot specified—

oraclebanking_enterprise_collectionsNot specified—

oraclebanking_platformNot specified—

oraclebi_publisherNot specified—

oraclebig_data_discoveryNot specified—

oraclebusiness_process_management_suiteNot specified—

oraclecommunications_analyticsNot specified—

oraclecommunications_application_session_controllerNot specified—

oraclecommunications_billing_and_revenue_managementNot specified—

oraclecommunications_diameter_signaling_routerNot specified—

oraclecommunications_eagle_application_processorNot specified—

oraclecommunications_element_managerNot specified—

oraclecommunications_interactive_session_recorderNot specified—

oraclecommunications_operations_monitorNot specified—

oraclecommunications_services_gatekeeperNot specified—

oraclecommunications_session_report_managerNot specified—

oraclecommunications_session_route_managerNot specified—

oraclecommunications_unified_inventory_managementNot specified—

oraclecommunications_webrtc_session_controllerNot specified—

oraclediagnostic_assistantNot specified—

oracleenterprise_manager_ops_centerNot specified—

oracleenterprise_session_border_controllerNot specified—

oraclefinancial_services_analytical_applications_infrastructureNot specified—

oraclefinancial_services_analytical_applications_reconciliation_frameworkNot specified—

oraclefinancial_services_asset_liability_managementNot specified—

oraclefinancial_services_balance_sheet_planningNot specified—

oraclefinancial_services_basel_regulatory_capital_basicNot specified—

oraclefinancial_services_basel_regulatory_capital_internal_ratings_based_approachNot specified—

oraclefinancial_services_data_foundationNot specified—

oraclefinancial_services_data_governance_for_us_regulatory_reportingNot specified—

oraclefinancial_services_data_integration_hubNot specified—

oraclefinancial_services_enterprise_financial_performance_analyticsNot specified—

oraclefinancial_services_funds_transfer_pricingNot specified—

oraclefinancial_services_hedge_management_and_ifrs_valuationsNot specified—

oraclefinancial_services_institutional_performance_analyticsNot specified—

oraclefinancial_services_liquidity_risk_managementNot specified—

oraclefinancial_services_liquidity_risk_measurement_and_managementNot specified—

oraclefinancial_services_loan_loss_forecasting_and_provisioningNot specified—

oraclefinancial_services_market_risk_measurement_and_managementNot specified—

oraclefinancial_services_price_creation_and_discoveryNot specified—

oraclefinancial_services_profitability_managementNot specified—

oraclefinancial_services_regulatory_reporting_for_de_nederlandsche_bankNot specified—

oraclefinancial_services_regulatory_reporting_for_european_banking_authorityNot specified—

oraclefinancial_services_regulatory_reporting_for_us_federal_reserveNot specified—

oraclefinancial_services_retail_customer_analyticsNot specified—

62 further entries not shown. The complete list is in the raw JSON document.

06 References

www.drupal.orghttps://www.drupal.org/sa-core-2019-006
www.synology.comhttps://www.synology.com/security/advisory/Synology_SA_19_19
www.debian.orgDSA-4434https://www.debian.org/security/2019/dsa-4434vendor-advisory
seclists.org20190421 [SECURITY] [DSA 4434-1] drupal7 security updatehttps://seclists.org/bugtraq/2019/Apr/32mailing-list
www.securityfocus.com108023http://www.securityfocus.com/bid/108023vdb-entry
lists.apache.org[airflow-commits] 20190428 [GitHub] [airflow] feng-tao commented on issue #5197: [AIRFLOW-XXX] Fix CVE-2019-11358https://lists.apache.org/thread.html/08720ef215ee7ab3386c05a1a90a7d1c852bf0706f176a7816bf65fc%40%3Ccommits.airflow.apache.org%3Emailing-list
lists.apache.org[airflow-commits] 20190428 [GitHub] [airflow] feng-tao opened a new pull request #5197: [AIRFLOW-XXX] Fix CVE-2019-11358https://lists.apache.org/thread.html/b736d0784cf02f5a30fbb4c5902762a15ad6d47e17e2c5a17b7d6205%40%3Ccommits.airflow.apache.org%3Emailing-list
lists.apache.org[airflow-commits] 20190428 [GitHub] [airflow] codecov-io commented on issue #5197: [AIRFLOW-XXX] Fix CVE-2019-11358https://lists.apache.org/thread.html/88fb0362fd40e5b605ea8149f63241537b8b6fb5bfa315391fc5cbb7%40%3Ccommits.airflow.apache.org%3Emailing-list
lists.apache.org[airflow-commits] 20190428 [GitHub] [airflow] XD-DENG merged pull request #5197: [AIRFLOW-XXX] Fix CVE-2019-11358https://lists.apache.org/thread.html/5928aa293e39d248266472210c50f176cac1535220f2486e6a7fa844%40%3Ccommits.airflow.apache.org%3Emailing-list
lists.apache.org[airflow-commits] 20190428 [GitHub] [airflow] XD-DENG commented on issue #5197: [AIRFLOW-XXX] Fix CVE-2019-11358https://lists.apache.org/thread.html/6097cdbd6f0a337bedd9bb5cc441b2d525ff002a96531de367e4259f%40%3Ccommits.airflow.apache.org%3Emailing-list
lists.debian.org[debian-lts-announce] 20190506 [SECURITY] [DLA 1777-1] jquery security updatehttps://lists.debian.org/debian-lts-announce/2019/05/msg00006.htmlmailing-list
lists.fedoraproject.orgFEDORA-2019-eba8e44ee6https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5IABSKTYZ5JUGL735UKGXL5YPRYOPUYI/vendor-advisory
lists.fedoraproject.orgFEDORA-2019-1a3edd7e8ahttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4UOAZIFCSZ3ENEFOR5IXX6NFAD3HV7FA/vendor-advisory
lists.fedoraproject.orgFEDORA-2019-7eaf0bbe7chttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KYH3OAGR2RTCHRA5NOKX2TES7SNQMWGO/vendor-advisory
lists.fedoraproject.orgFEDORA-2019-2a0ce0c58chttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RLXRX23725JL366CNZGJZ7AQQB7LHQ6F/vendor-advisory
lists.fedoraproject.orgFEDORA-2019-a06dffab1chttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QV3PKZC3PQCO3273HAT76PAQZFBEO4KP/vendor-advisory
lists.fedoraproject.orgFEDORA-2019-f563e66380https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WZW27UCJ5CYFL4KFFFMYMIBNMIU2ALG5/vendor-advisory
seclists.org20190509 dotCMS v5.1.1 Vulnerabilitieshttps://seclists.org/bugtraq/2019/May/18mailing-list
packetstormsecurity.comhttp://packetstormsecurity.com/files/152787/dotCMS-5.1.1-Vulnerable-Dependencies.html
seclists.org20190510 dotCMS v5.1.1 HTML Injection & XSS Vulnerabilityhttp://seclists.org/fulldisclosure/2019/May/11mailing-list
seclists.org20190510 dotCMS v5.1.1 Vulnerabilitieshttp://seclists.org/fulldisclosure/2019/May/10mailing-list
seclists.org20190510 Re: dotCMS v5.1.1 HTML Injection & XSS Vulnerabilityhttp://seclists.org/fulldisclosure/2019/May/13mailing-list
lists.debian.org[debian-lts-announce] 20190520 [SECURITY] [DLA 1797-1] drupal7 security updatehttps://lists.debian.org/debian-lts-announce/2019/05/msg00029.htmlmailing-list
www.openwall.com[oss-security] 20190603 Django: CVE-2019-12308 AdminURLFieldWidget XSS (plus patched bundled jQuery for CVE-2019-11358)http://www.openwall.com/lists/oss-security/2019/06/03/2mailing-list
packetstormsecurity.comhttp://packetstormsecurity.com/files/153237/RetireJS-CORS-Issue-Script-Execution.html
access.redhat.comRHSA-2019:1456https://access.redhat.com/errata/RHSA-2019:1456vendor-advisory
www.debian.orgDSA-4460https://www.debian.org/security/2019/dsa-4460vendor-advisory
seclists.org20190612 [SECURITY] [DSA 4460-1] mediawiki security updatehttps://seclists.org/bugtraq/2019/Jun/12mailing-list
lists.opensuse.orgopenSUSE-SU-2019:1839http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00006.htmlvendor-advisory
access.redhat.comRHBA-2019:1570https://access.redhat.com/errata/RHBA-2019:1570vendor-advisory
lists.opensuse.orgopenSUSE-SU-2019:1872http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00025.htmlvendor-advisory
lists.apache.org[roller-commits] 20190820 [jira] [Created] (ROL-2150) Fix Js security vulnerabilities detected using retire jshttps://lists.apache.org/thread.html/ba79cf1658741e9f146e4c59b50aee56656ea95d841d358d006c18b6%40%3Ccommits.roller.apache.org%3Emailing-list
access.redhat.comRHSA-2019:2587https://access.redhat.com/errata/RHSA-2019:2587vendor-advisory
security.netapp.comhttps://security.netapp.com/advisory/ntap-20190919-0001/
access.redhat.comRHSA-2019:3023https://access.redhat.com/errata/RHSA-2019:3023vendor-advisory
access.redhat.comRHSA-2019:3024https://access.redhat.com/errata/RHSA-2019:3024vendor-advisory
lists.apache.org[drill-dev] 20191017 Dependencies used by Drill contain known vulnerabilitieshttps://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3Emailing-list
lists.apache.org[drill-dev] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilitieshttps://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3Emailing-list
lists.apache.org[drill-issues] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilitieshttps://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3Emailing-list
lists.apache.org[nifi-commits] 20191113 svn commit: r1869773 - /nifi/site/trunk/security.htmlhttps://lists.apache.org/thread.html/bcce5a9c532b386c68dab2f6b3ce8b0cc9b950ec551766e76391caa3%40%3Ccommits.nifi.apache.org%3Emailing-list
www.tenable.comhttps://www.tenable.com/security/tns-2019-08
lists.apache.org[nifi-commits] 20200123 svn commit: r1873083 - /nifi/site/trunk/security.htmlhttps://lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b%40%3Ccommits.nifi.apache.org%3Emailing-list
lists.debian.org[debian-lts-announce] 20200224 [SECURITY] [DLA 2118-1] otrs2 security updatehttps://lists.debian.org/debian-lts-announce/2020/02/msg00024.htmlmailing-list
packetstormsecurity.comhttp://packetstormsecurity.com/files/156743/OctoberCMS-Insecure-Dependencies.html
www.tenable.comhttps://www.tenable.com/security/tns-2020-02
lists.apache.org[syncope-dev] 20200423 Jquery version on 2.1.x/2.0.xhttps://lists.apache.org/thread.html/r38f0d1aa3c923c22977fe7376508f030f22e22c1379fbb155bf29766%40%3Cdev.syncope.apache.org%3Emailing-list
lists.apache.org[flink-dev] 20200513 [jira] [Created] (FLINK-17675) Resolve CVE-2019-11358 from jqueryhttps://lists.apache.org/thread.html/r7aac081cbddb6baa24b75e74abf0929bf309b176755a53e3ed810355%40%3Cdev.flink.apache.org%3Emailing-list
lists.apache.org[flink-issues] 20200513 [jira] [Created] (FLINK-17675) Resolve CVE-2019-11358 from jqueryhttps://lists.apache.org/thread.html/rac25da84ecdcd36f6de5ad0d255f4e967209bbbebddb285e231da37d%40%3Cissues.flink.apache.org%3Emailing-list
lists.apache.org[flink-issues] 20200518 [jira] [Commented] (FLINK-17675) Resolve CVE-2019-11358 from jqueryhttps://lists.apache.org/thread.html/r2041a75d3fc09dec55adfd95d598b38d22715303f65c997c054844c9%40%3Cissues.flink.apache.org%3Emailing-list
lists.apache.org[flink-issues] 20200518 [jira] [Updated] (FLINK-17675) Resolve CVE-2019-11358 from jqueryhttps://lists.apache.org/thread.html/r7e8ebccb7c022e41295f6fdb7b971209b83702339f872ddd8cf8bf73%40%3Cissues.flink.apache.org%3Emailing-list
lists.apache.org[flink-issues] 20200518 [jira] [Assigned] (FLINK-17675) Resolve CVE-2019-11358 from jqueryhttps://lists.apache.org/thread.html/r41b5bfe009c845f67d4f68948cc9419ac2d62e287804aafd72892b08%40%3Cissues.flink.apache.org%3Emailing-list
lists.apache.org[flink-issues] 20200520 [jira] [Closed] (FLINK-17675) Resolve CVE-2019-11358 from jqueryhttps://lists.apache.org/thread.html/r2baacab6e0acb5a2092eb46ae04fd6c3e8277b4fd79b1ffb7f3254fa%40%3Cissues.flink.apache.org%3Emailing-list
www.oracle.comhttps://www.oracle.com/security-alerts/cpuapr2020.html
lists.apache.org[storm-dev] 20200708 [GitHub] [storm] Crim opened a new pull request #3305: [STORM-3553] Upgrade jQuery from 1.11.1 to 3.5.1https://lists.apache.org/thread.html/r7d64895cc4dff84d0becfc572b20c0e4bf9bfa7b10c6f5f73e783734%40%3Cdev.storm.apache.org%3Emailing-list
www.oracle.comhttps://www.oracle.com/security-alerts/cpujul2020.html
www.oracle.comhttps://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
www.oracle.comhttps://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
www.oracle.comhttps://www.oracle.com/security-alerts/cpujan2020.html
backdropcms.orghttps://backdropcms.org/security/backdrop-sa-core-2019-009
blog.jquery.comhttps://blog.jquery.com/2019/04/10/jquery-3-4-0-released/
snyk.iohttps://snyk.io/vuln/SNYK-JS-JQUERY-174006
github.comhttps://github.com/jquery/jquery/pull/4333
github.comhttps://github.com/jquery/jquery/commit/753d591aea698e57d6db58c9f722cd0808619b1b
www.privacy-wise.comhttps://www.privacy-wise.com/mitigating-cve-2019-11358-in-old-versions-of-jquery/
www.oracle.comhttps://www.oracle.com/security-alerts/cpuoct2020.html
kb.pulsesecure.nethttps://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44601
www.oracle.comhttps://www.oracle.com/security-alerts/cpujan2021.html
www.oracle.comhttps://www.oracle.com/security-alerts/cpuApr2021.html
www.oracle.comhttps://www.oracle.com//security-alerts/cpujul2021.html
www.oracle.comhttps://www.oracle.com/security-alerts/cpuoct2021.html
www.oracle.comhttps://www.oracle.com/security-alerts/cpujan2022.html
supportportal.juniper.nethttps://supportportal.juniper.net/s/article/2021-07-Security-Bulletin-Junos-OS-Multiple-J-Web-vulnerabilities-resolved-in-Junos-OS-21-2R1
lists.debian.org[debian-lts-announce] 20230831 [SECURITY] [DLA 3551-1] otrs2 security updatehttps://lists.debian.org/debian-lts-announce/2023/08/msg00040.htmlmailing-list

07 Fixed in

AlmaLinux 8

custodia
Fixed in 0.6.0-3.module_el8.6.0+2881+2f24dc92
python3-custodia
Fixed in 0.6.0-3.module_el8.6.0+2881+2f24dc92
python3-jwcrypto
Fixed

A version is affected if any line below covers it.
- Affected before 0.5.0-1.module_el8.5.0+2641+983b221b
- Affected before 0.5.0-1.module_el8.6.0+2737+7e73ea90
- Affected before 0.5.0-1.module_el8.6.0+2881+2f24dc92
python3-kdcproxy
Fixed in 0.4-5.module_el8.6.0+2881+2f24dc92
python3-pyusb
Fixed

A version is affected if any line below covers it.
- Affected before 1.0.0-9.module_el8.5.0+2641+983b221b
- Affected before 1.0.0-9.module_el8.6.0+2737+7e73ea90
- Affected before 1.0.0-9.module_el8.6.0+2881+2f24dc92
python3-qrcode
Fixed

A version is affected if any line below covers it.
- Affected before 5.1-12.module_el8.5.0+2641+983b221b
- Affected before 5.1-12.module_el8.6.0+2737+7e73ea90
- Affected before 5.1-12.module_el8.6.0+2881+2f24dc92
python3-qrcode-core
Fixed

A version is affected if any line below covers it.
- Affected before 5.1-12.module_el8.5.0+2641+983b221b
- Affected before 5.1-12.module_el8.6.0+2737+7e73ea90
- Affected before 5.1-12.module_el8.6.0+2881+2f24dc92
python3-yubico
Fixed

A version is affected if any line below covers it.
- Affected before 1.3.2-9.module_el8.5.0+2641+983b221b
- Affected before 1.3.2-9.module_el8.6.0+2737+7e73ea90
- Affected before 1.3.2-9.module_el8.6.0+2881+2f24dc92

Arch Linux

python-django
Fixed in 2.2.2-1

Source: Arch Linux Security Tracker, the Arch Linux security team. Reformatted by exploit.cc.

CloudLinux 8

custodia
Fixed in 0.6.0-3.module_el8.6.0+2881+2f24dc92
python3-custodia
Fixed in 0.6.0-3.module_el8.6.0+2881+2f24dc92
python3-jwcrypto
Fixed

A version is affected if any line below covers it.
- Affected before 0.5.0-1.module_el8.5.0+2641+983b221b
- Affected before 0.5.0-1.module_el8.6.0+2737+7e73ea90
- Affected before 0.5.0-1.module_el8.6.0+2881+2f24dc92
python3-kdcproxy
Fixed in 0.4-5.module_el8.6.0+2881+2f24dc92
python3-pyusb
Fixed

A version is affected if any line below covers it.
- Affected before 1.0.0-9.module_el8.5.0+2641+983b221b
- Affected before 1.0.0-9.module_el8.6.0+2737+7e73ea90
- Affected before 1.0.0-9.module_el8.6.0+2881+2f24dc92
python3-qrcode
Fixed

A version is affected if any line below covers it.
- Affected before 5.1-12.module_el8.5.0+2641+983b221b
- Affected before 5.1-12.module_el8.6.0+2737+7e73ea90
- Affected before 5.1-12.module_el8.6.0+2881+2f24dc92
python3-qrcode-core
Fixed

A version is affected if any line below covers it.
- Affected before 5.1-12.module_el8.5.0+2641+983b221b
- Affected before 5.1-12.module_el8.6.0+2737+7e73ea90
- Affected before 5.1-12.module_el8.6.0+2881+2f24dc92
python3-yubico
Fixed

A version is affected if any line below covers it.
- Affected before 1.3.2-9.module_el8.5.0+2641+983b221b
- Affected before 1.3.2-9.module_el8.6.0+2737+7e73ea90
- Affected before 1.3.2-9.module_el8.6.0+2881+2f24dc92

Derived from AlmaLinux 8. Partial coverage: only packages taken from AlmaLinux 8 are listed.

Debian 12

mediawiki
Fixed in 1:1.31.2-1
node-jquery
Fixed in 2.2.4+dfsg-4

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 13

mediawiki
Fixed in 1:1.31.2-1
node-jquery
Fixed in 2.2.4+dfsg-4

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 14

mediawiki
Fixed in 1:1.31.2-1
node-jquery
Fixed in 2.2.4+dfsg-4

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.