|
Vulnerabilities
< Back

CVE-2019-11358

Updated on 20 Apr 2019

Severity

6.1 Medium severity

Details

CVSS score
6.1
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CWE ID
Links
NISTCIRCLRHELUbuntu

Overview

About vulnerability

jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, …) because of Object.prototype pollution. If an unsanitized source object contained an enumerable proto property, it could extend the native Object.prototype.

Details

Affected product:
Acorn , Apache Hive , Apache Spark , Apache Struts , Apache Tapestry , Jackson , jQuery , json4s , scala , scala-compiler , scala-parser-combinators , testng
Affected packages:
spark-streaming_2.11 @ 2.4.8 (+215 more)
jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, …) because of Object.prototype pollution. If an unsanitized source object contained an enumerable proto property, it could extend the native Object.prototype.

Fixes