What’s Vulnerable › Vulnerabilities

CVE-2019-11358: XSS in jQuery as used in Drupal, Backdrop CMS, and other products

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 86.8% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2019-04-20 · updated 2026-06-17
• Weakness: CWE-1321

Description

jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Object.prototype.

Affected products

• backdropcms Backdrop: from 1.11.0 before 1.11.9; from 1.12.0 before 1.12.6 — fixed in 1.11.9, 1.12.6
• Debian Linux: 8.0, 9.0, 10.0
• Drupal: from 7.0 before 7.66; from 8.5.0 before 8.5.15; from 8.6.0 before 8.6.15 — fixed in 7.66, 8.5.15, 8.6.15
• Fedoraproject Fedora: 28, 29, 30
• Joomla!: from 3.0.0 through 3.9.4
• jQuery: before 3.4.0 — fixed in 3.4.0
• Juniper Junos OS: 21.2
• OnCommand System Manager 9.x: from 3.0 through 3.1.3
• NetApp SnapCenter: all versions
• openSUSE Backports Sle: 15.0-sp1
• openSUSE Leap: 15.1
• Oracle Corporation Oracle Agile Product Lifecycle Management for Process: 6.1, 6.2.0.0, 6.2.1.0, 6.2.2.0, 6.2.3.0
• Oracle Corporation Application Express: before 19.1 — fixed in 19.1
• Oracle Application Service Level Management: 13.2.0.0, 13.3.0.0
• Oracle Corporation Oracle Application Testing Suite: 12.5.0.3, 13.1.0.1, 13.2, 13.2.0.1, 13.3, 13.3.0.1
• Oracle Corporation Banking Digital Experience: 18.1, 18.2, 18.3, 19.1, 19.2, 20.1
• Oracle Banking Enterprise Collections: from 2.7.0 through 2.8.0
• Oracle Banking Platform: from 2.4.0 through 2.10.0
• Oracle Corporation Oracle BI Publisher: 5.5.0.0.0, 12.2.1.3.0, 12.2.1.4.0
• Oracle Big Data Discovery: 1.6
• Oracle Corporation Oracle Business Process Management Suite: 12.2.1.3.0, 12.2.1.4.0
• Oracle Communications Analytics: 12.1.1
• Oracle Communications Application Session Controller: 3.8m0
• Oracle Corporation Communications Billing and Revenue Management: 7.5, 7.5.0.23.0, 12.0, 12.0.0.3.0
• Oracle Corporation Communications Diameter Signaling Router (DSR): 8.0.0, 8.1, 8.2, 8.2.1
• Oracle Communications Eagle Application Processor: from 16.1.0 through 16.4.0
• Oracle Communications Element Manager: 8.1.1, 8.2.0, 8.2.1
• Oracle Corporation Communications Interactive Session Recorder: from 6.0 through 6.4
• Oracle Corporation Communications Operations Monitor: from 4.1 through 4.3; 3.4, 4.0, 4.1.0
• Oracle Communications Services Gatekeeper: 7.0

How to fix

Upgrade to a fixed version: backdropcms Backdrop 1.11.9, 1.12.6; Drupal 7.66, 8.5.15, 8.6.15; jQuery 3.4.0; Oracle Corporation Application Express 19.1. Check the vendor advisory for mitigations.

References

• http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00006.html
• http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00025.html
• http://packetstormsecurity.com/files/152787/dotCMS-5.1.1-Vulnerable-Dependencies.html
• http://packetstormsecurity.com/files/153237/RetireJS-CORS-Issue-Script-Execution.html
• http://packetstormsecurity.com/files/156743/OctoberCMS-Insecure-Dependencies.html
• http://seclists.org/fulldisclosure/2019/May/10
• http://seclists.org/fulldisclosure/2019/May/11
• http://seclists.org/fulldisclosure/2019/May/13
• http://www.openwall.com/lists/oss-security/2019/06/03/2
• http://www.securityfocus.com/bid/108023
• https://access.redhat.com/errata/RHBA-2019:1570
• https://access.redhat.com/errata/RHSA-2019:1456

Get alerted when CVE-2019-11358 or the next vulnerability affects your stack