jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Object.prototype.
References
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
Configuration 3 (hide)
|
Configuration 4 (hide)
|
Configuration 5 (hide)
|
Configuration 6 (hide)
|
Configuration 7 (hide)
|
Configuration 8 (hide)
|
Configuration 9 (hide)
|
Configuration 10 (hide)
|
Configuration 11 (hide)
|
History
No history.
Information
Published : 2019-04-20 00:29
Updated : 2024-11-21 04:20
NVD link : CVE-2019-11358
Mitre link : CVE-2019-11358
CVE.ORG link : CVE-2019-11358
JSON object : View
Products Affected
oracle
- communications_services_gatekeeper
- banking_enterprise_collections
- hospitality_simphony
- communications_billing_and_revenue_management
- insurance_data_foundation
- identity_manager
- retail_point-of-service
- healthcare_foundation
- communications_eagle_application_processor
- financial_services_regulatory_reporting_for_de_nederlandsche_bank
- financial_services_liquidity_risk_management
- retail_customer_insights
- communications_analytics
- financial_services_data_foundation
- hospitality_guest_access
- retail_customer_management_and_segmentation_foundation
- financial_services_balance_sheet_planning
- retail_back_office
- big_data_discovery
- transportation_management
- system_utilities
- communications_diameter_signaling_router
- financial_services_price_creation_and_discovery
- financial_services_basel_regulatory_capital_basic
- financial_services_regulatory_reporting_for_european_banking_authority
- policy_automation_for_mobile_devices
- jd_edwards_enterpriseone_tools
- communications_operations_monitor
- siebel_ui_framework
- financial_services_hedge_management_and_ifrs_valuations
- primavera_unifier
- financial_services_data_integration_hub
- siebel_mobile_applications
- enterprise_session_border_controller
- hospitality_materials_control
- application_service_level_management
- business_process_management_suite
- webcenter_sites
- communications_unified_inventory_management
- jdeveloper_and_adf
- knowledge
- rest_data_services
- financial_services_market_risk_measurement_and_management
- banking_platform
- weblogic_server
- peoplesoft_enterprise_peopletools
- insurance_accounting_analyzer
- policy_automation
- policy_automation_connector_for_siebel
- financial_services_basel_regulatory_capital_internal_ratings_based_approach
- retail_returns_management
- financial_services_profitability_management
- financial_services_retail_performance_analytics
- jdeveloper
- service_bus
- fusion_middleware_mapviewer
- financial_services_analytical_applications_reconciliation_framework
- diagnostic_assistant
- communications_element_manager
- financial_services_funds_transfer_pricing
- insurance_allocation_manager_for_enterprise_profitability
- communications_session_route_manager
- financial_services_revenue_management_and_billing
- enterprise_manager_ops_center
- tape_library_acsls
- financial_services_data_governance_for_us_regulatory_reporting
- banking_digital_experience
- financial_services_enterprise_financial_performance_analytics
- bi_publisher
- communications_session_report_manager
- communications_interactive_session_recorder
- financial_services_regulatory_reporting_for_us_federal_reserve
- financial_services_analytical_applications_infrastructure
- real-time_scheduler
- application_testing_suite
- insurance_performance_insight
- financial_services_loan_loss_forecasting_and_provisioning
- financial_services_asset_liability_management
- insurance_ifrs_17_analyzer
- storagetek_tape_analytics_sw_tool
- retail_central_office
- utilities_mobile_workforce_management
- insurance_insbridge_rating_and_underwriting
- agile_product_lifecycle_management_for_process
- communications_application_session_controller
- financial_services_institutional_performance_analytics
- application_express
- healthcare_translational_research
- financial_services_liquidity_risk_measurement_and_management
- financial_services_retail_customer_analytics
- primavera_gateway
- communications_webrtc_session_controller
joomla
- joomla\!
jquery
- jquery
redhat
- virtualization_manager
- cloudforms
juniper
- junos
drupal
- drupal
debian
- debian_linux
fedoraproject
- fedora
netapp
- snapcenter
- oncommand_system_manager
opensuse
- backports_sle
- leap
backdropcms
- backdrop
CWE
CWE-1321
Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
