CVE-2019-11358
ADVISORY - githubSummary
jQuery from 1.1.4 until 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Object.prototype.
Common Weakness Enumeration (CWE)
Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
NIST
2.8
CVSS SCORE
6.1mediumGitHub
CVSS SCORE
6.1mediumAlpine
-
Debian
-
Ubuntu
2.8
CVSS SCORE
6.1lowAlma
-
CVSS SCORE
N/AmediumAmazon
-
CVSS SCORE
N/AmediumAmazon
-
CVSS SCORE
N/AmediumRed Hat
2.2
CVSS SCORE
5.6mediumRocky
-
CVSS SCORE
N/AlowRocky
-
CVSS SCORE
N/AlowRocky
-
CVSS SCORE
N/AmediumOracle
-
CVSS SCORE
N/AmediumOracle
-
CVSS SCORE
N/AmediumOracle
-
CVSS SCORE
N/AmediumOracle
-
CVSS SCORE
N/AmediumOracle
-
CVSS SCORE
N/AhighintheWild
-
-