CVE-2019-11358: backdropcms backdrop
Modified
AliasesGHSA-6c3j-c64m-qhgqDRUPAL-CORE-2019-006PYSEC-2026-628SNYK-JS-JQUERY-174006RHSA-2020:1325RHSA-2020:5581UBUNTU-CVE-2019-11358DEBIAN-CVE-2019-11358DLA-1777-1DLA-2118-1DSA-4434-1ALPINE-CVE-2019-11358
Published 19-04-2019Last modified 15-11-2024
Vulnerability summary
CVE-2019-11358 is a medium (CVSS 6.1) vulnerability in backdropcms backdrop. EPSS estimates a 86.82% chance of exploitation in the next 30 days, higher than 99.7% of scored vulnerabilities. 2 public exploits are recorded.
Priority
Routine
Not severe (CVSS 6.1, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?CVSS score
6.1/10
010
Medium · v3.1 (NVD)EPSS score
86.82%
0%100%
Critical · 0.00 pp in 30 daysKEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits2reference, exploit-database
Advisory lineage
Upstream 0 · Downstream 31 · Duplicates 1 · Related 11DLA-1797-1DLA-3551-1DSA-4460-1MGASA-2019-0279OPENSUSE-SU-2019:1839-1OPENSUSE-SU-2019:1872-1OPENSUSE-SU-2024:0231-1OPENSUSE-SU-2024:11205-1OPENSUSE-SU-2024:13887-1OPENSUSE-SU-2024:14208-1OPENSUSE-SU-2026:10005-1OPENSUSE-SU-2026:11235-1OPENSUSE-SU-2026:11248-1OPENSUSE-SU-2026:11270-1RHBA-2019:1570RHBA-2020:0402RHSA-2019:2587RHSA-2019:3023RHSA-2019:3024RHSA-2020:3936RHSA-2020:4670RHSA-2020:4847RHSA-2021:4142RHSA-2022:7343RHSA-2023:0552RHSA-2023:0553RHSA-2023:0554RHSA-2023:1043RHSA-2023:1044RHSA-2023:1045USN-7622-1CVE-2019-5428
Timeline
- 19-04-2019PublishedVulnerability first disclosed.
- 15-11-2024Last modifiedVulnerability information updated.
Description
jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Object.prototype.
CVSS metrics
11 scores · 10 sources · 3 versionsMedium 6.1Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NSourcesAll 9 agree
- OSV · PypiEcosystem advisory · calculated6.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- OSV · UbuntuEcosystem advisory · calculated6.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- OSV · DebianEcosystem advisory · calculated6.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- OSV · NpmEcosystem advisory · calculated6.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- OSV · MavenEcosystem advisory · calculated6.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- OSV · NugetEcosystem advisory · calculated6.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- OSV · RubygemsEcosystem advisory · calculated6.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- OSV · AlpineEcosystem advisory · calculated6.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Medium 5.6Preferred score · OSV · Red hat (Ecosystem advisory) · calculated from vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:LSourcesSingle source
Medium 4.3Preferred score · NVD (NIST)
AV:N/AC:M/Au:N/C:N/I:P/A:NSourcesSingle source
EPSS trend
Probability
86.82%
Chance of exploitation in the next 30 days
Percentile
100%
Versus all other CVEs
30-day change
No change 0.00 pp
From 86.82% on 04-10-2026
04-10-202603-11-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
2 foundExploit Reference (snyk.io)
Maturity: unknown
jQuery 3.3.1 - Prototype Pollution & XSS Exploit
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Version check
Known conditions: network-reachable, no authentication, user interaction (CVSS vector). Other conditions: not stated in public data.
Oracle92 products
- agile_product_lifecycle_management_for_process6.1 | 6.2.0.0 | 6.2.1.0 | 6.2.2.0 | 6.2.3.0
- application_express< 19.1
- application_service_level_management13.2.0.0 | 13.3.0.0
- application_testing_suite12.5.0.3 | 13.1.0.1 | 13.2 | 13.2.0.1 | 13.3 | 13.3.0.1
- banking_digital_experience18.1 | 18.2 | 18.3 | 19.1 | 19.2 | 20.1
Debian6 products
- drupal7< 7.52-2+deb9u8
- jquery< 1.7.2+dfsg-3.2+deb8u6
- mediawiki< 1:1.31.2-1
- node-jquery< 2.2.4+dfsg-4
- otrs2< 3.3.18-1+deb8u14
Ubuntu5 products
- drupal7All versions (No fix recorded)
- jquery< 1.7.2+dfsg-2ubuntu1+esm1 | < 1.11.3+dfsg-4ubuntu0.1~esm1 | < 3.2.1-1ubuntu0.1~esm1
- mediawikiAll versions (No fix recorded)
- node-jqueryAll versions (No fix recorded)
- otrs2All versions (No fix recorded)
Redhat4 products
- cloudforms4.7
- virtualization_manager4.3
- python-XStatic-jQuery< 0:3.4.1.0-1.el8ost | < 0:2.2.4.1-3.el7ost
- python3-XStatic-jQuery< 0:3.4.1.0-1.el8ost
Alpine2 products
- drupal7< 7.67-r0
- rabbitmq-server< 3.7.17-r0
Netapp2 products
- oncommand_system_manager≥ 3.0, ≤ 3.1.3
- snapcenterna
Opensuse2 products
- backports_sle15.0:sp1
- leapEOL15.1
Backdropcms1 product
- backdrop≥ 1.11.0, < 1.11.9 | ≥ 1.12.0, < 1.12.6
Drupal1 product
- drupal≥ 7.0, < 7.66 | ≥ 8.5.0, < 8.5.15 | ≥ 8.6.0, < 8.6.15
Fedoraproject1 product
- fedoraEOL28 | 29 | 30
Joomla1 product
- joomla\!≥ 3.0.0, ≤ 3.9.4
Jquery1 product
- jquery< 3.4.0
Juniper1 product
- junos21.2
Maximebf1 product
- debugbar< 1.19.0
Npm1 product
- jquery≥ 1.1.4, < 3.4.0
NuGet1 product
- jquery≥ 1.1.4, < 3.4.0
Org.webjars.npm1 product
- jquery≥ 1.1.4, < 3.4.0
PyPI1 product
- django≥ 2.0a1, < 2.1.9 | ≥ 2.2a1, < 2.2.2
RubyGems1 product
- jquery-rails< 4.3.4
19 vendors · 125 products
References
134 linksShow all 100 references
- packetstormsecurity.com/files/152787/dotCMS-5.1.1-Vulnerable-Dependencies.htmlThird Party AdvisoryVDB EntryWEB
- packetstormsecurity.com/files/153237/RetireJS-CORS-Issue-Script-Execution.htmlThird Party AdvisoryVDB EntryWEB
- lists.opensuse.org/opensuse-security-announce/2019-08/msg00006.htmlVendor AdvisoryMailing ListThird Party AdvisoryWEB
- lists.opensuse.org/opensuse-security-announce/2019-08/msg00025.htmlVendor AdvisoryMailing ListThird Party AdvisoryWEB
- security.netapp.com/advisory/ntap-20190919-0001/Third Party Advisory
- packetstormsecurity.com/files/156743/OctoberCMS-Insecure-Dependencies.htmlThird Party AdvisoryVDB EntryWEB
- github.com/jquery/jquery/commit/753d591aea698e57d6db58c9f722cd0808619b1bPatchThird Party AdvisoryWEB
Showing 100 of 134.