CVE-2019-11358

Aliases:GHSA-6c3j-c64m-qhgqDRUPAL-CORE-2019-006
Advisory lineage Upstream: 0 Downstream: 35
Modified
Published: 19 Apr 2019, 00:00
Last modified:15 Nov 2024, 15:11

Vulnerability Summary

Overall Risk (default)
medium
35/100
CVSS Score
6.1 MEDIUM
v3.1 (nvd)
EPSS Score
1.53% LOW
2% probability -0.94%
KEV
Not listed
Ransomware
No reports
Public exploits
2 found
Dark Web
Not detected

Timeline

19 Apr 2019, 00:00
Published
Vulnerability first disclosed
15 Nov 2024, 15:11
Last Modified
Vulnerability information updated

Description

jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Object.prototype.

CVSS Metrics

  • v3.1•MEDIUM•Score: 6.1CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
  • v2.0•MEDIUM•Score: 4.3AV:N/AC:M/Au:N/C:N/I:P/A:N

EPSS Trends

Current EPSS score: 1.53%• Percentile: 82%

Techniques & Countermeasures

  • CWE-1321•Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

    The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.

Affected Systems

  • backdropcms•backdrop

    ≥ 1.11.0, < 1.11.9 | ≥ 1.12.0, < 1.12.6

  • maximebf•debugbar

    < 1.19.0

  • debian•debian_linux

    8.0 | 9.0 | 10.0

  • drupal•drupal

    ≥ 7.0, < 7.66 | ≥ 8.5.0, < 8.5.15 | ≥ 8.6.0, < 8.6.15

  • fedoraproject•fedora

    28 | 29 | 30

  • RubyGems•jquery-rails

    < 4.3.4

  • Unknown•Joomla!

    ≥ 3.0.0, ≤ 3.9.4

  • Unknown•JQuery

    < 3.4.0

  • juniper•junos

    21.2

  • org.webjars.npm•jquery

    ≥ 1.1.4, < 3.4.0

  • netapp•oncommand_system_manager

    ≥ 3.0, ≤ 3.1.3

  • netapp•snapcenter

    na

  • Npm•jquery

    ≥ 1.1.4, < 3.4.0

  • NuGet•jquery

    ≥ 1.1.4, < 3.4.0

  • opensuse•backports_sle

    15.0:sp1

  • opensuse•leap

    15.1

  • oracle•agile_product_lifecycle_management_for_process

    6.1 | 6.2.0.0 | 6.2.1.0 | 6.2.2.0 | 6.2.3.0

  • oracle•application_express

    < 19.1

  • oracle•application_service_level_management

    13.2.0.0 | 13.3.0.0

  • oracle•application_testing_suite

    12.5.0.3 | 13.1.0.1 | 13.2 | 13.2.0.1 | 13.3 | 13.3.0.1

  • oracle•banking_digital_experience

    18.1 | 18.2 | 18.3 | 19.1 | 19.2 | 20.1

  • oracle•banking_enterprise_collections

    ≥ 2.7.0, ≤ 2.8.0

  • oracle•banking_platform

    ≥ 2.4.0, ≤ 2.10.0

  • oracle•bi_publisher

    5.5.0.0.0 | 12.2.1.3.0 | 12.2.1.4.0

  • oracle•big_data_discovery

    1.6

  • oracle•business_process_management_suite

    12.2.1.3.0 | 12.2.1.4.0

  • oracle•communications_analytics

    12.1.1

  • oracle•communications_application_session_controller

    3.8m0

  • oracle•communications_billing_and_revenue_management

    7.5 | 7.5.0.23.0 | 12.0 | 12.0.0.3.0

  • oracle•communications_diameter_signaling_router

    8.0.0 | 8.1 | 8.2 | 8.2.1

  • oracle•communications_eagle_application_processor

    ≥ 16.1.0, ≤ 16.4.0

  • oracle•communications_element_manager

    8.1.1 | 8.2.0 | 8.2.1

  • oracle•communications_interactive_session_recorder

    ≥ 6.0, ≤ 6.4

  • oracle•communications_operations_monitor

    ≥ 4.1, ≤ 4.3 | 3.4 | 4.0 | 4.1.0

  • oracle•communications_services_gatekeeper

    7.0

  • oracle•communications_session_report_manager

    8.1.1 | 8.2.0 | 8.2.1

  • oracle•communications_session_route_manager

    8.1.1 | 8.2.0 | 8.2.1

  • oracle•communications_unified_inventory_management

    7.3 | 7.4.0

  • oracle•communications_webrtc_session_controller

    7.2

  • oracle•diagnostic_assistant

    2.12.36

  • oracle•enterprise_manager_ops_center

    12.3.3 | 12.4.0 | 12.4.0.0

  • oracle•enterprise_session_border_controller

    8.4

  • oracle•financial_services_analytical_applications_infrastructure

    ≥ 7.3.3, ≤ 7.3.5 | ≥ 8.0.2, ≤ 8.1.0

  • oracle•financial_services_analytical_applications_reconciliation_framework

    ≥ 8.0.4, ≤ 8.0.7 | 8.1.0

  • oracle•financial_services_asset_liability_management

    ≥ 8.0.4, ≤ 8.0.7 | 8.1.0

  • oracle•financial_services_balance_sheet_planning

    8.0.8

  • oracle•financial_services_basel_regulatory_capital_basic

    ≥ 8.0.4, ≤ 8.0.7 | 8.1.0

  • oracle•financial_services_basel_regulatory_capital_internal_ratings_based_approach

    ≥ 8.0.4, ≤ 8.0.7 | 8.1.0

  • oracle•financial_services_data_foundation

    ≥ 8.0.4, ≤ 8.0.8

  • oracle•financial_services_data_governance_for_us_regulatory_reporting

    ≥ 8.0.6, ≤ 8.0.9

Showing first 50 affected entries in server-rendered view.

References (119)