Vulnerabilities
Misconfiguration
Compliance
CVE Vulnerabilities

CVE-2019-11358

Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

Published: Apr 20, 2019 | Modified: Nov 21, 2024
CVSS 3.x
6.1
MEDIUM
Source:
NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS 2.x
4.3 MEDIUM
AV:N/AC:M/Au:N/C:N/I:P/A:N
RedHat/V2
RedHat/V3
5.6 MODERATE
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Ubuntu
LOW
Vulnerability-free packages from our partners
root.io logo minimus.io logo echo.ai logo
Additional information
NVDhttps://nvd.nist.gov/vuln/detail/CVE-2019-11358
CWEhttps://cwe.mitre.org/data/definitions/1321.html

jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, …) because of Object.prototype pollution. If an unsanitized source object contained an enumerable proto property, it could extend the native Object.prototype.

Weakness

The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.

Affected Software

NameVendorStart VersionEnd Version
JqueryJquery*3.4.0 (excluding)
CloudForms Management Engine 5.10RedHatansible-tower-0:3.5.2-1.el7at*
CloudForms Management Engine 5.10RedHatcfme-0:5.10.9.1-1.el7cf*
CloudForms Management Engine 5.10RedHatcfme-amazon-smartstate-0:5.10.9.1-1.el7cf*
CloudForms Management Engine 5.10RedHatcfme-appliance-0:5.10.9.1-1.el7cf*
CloudForms Management Engine 5.10RedHatcfme-gemset-0:5.10.9.1-1.el7cf*
CloudForms Management Engine 5.10RedHatovirt-ansible-hosted-engine-setup-0:1.0.23-1.el7ev*
CloudForms Management Engine 5.10RedHatovirt-ansible-roles-0:1.1.7-1.el7ev*
CloudForms Management Engine 5.10RedHatovirt-ansible-vm-infra-0:1.1.19-1.el7ev*
CloudForms Management Engine 5.10RedHatv2v-conversion-host-0:1.14.2-1.el7ev*
Red Hat Enterprise Linux 7RedHatipa-0:4.6.8-5.el7*
Red Hat Enterprise Linux 7RedHatpcs-0:0.9.169-3.el7_9.3*
Red Hat Enterprise Linux 8RedHatidm:client-8030020200923172426.05ac3f11*
Red Hat Enterprise Linux 8RedHatidm:DL1-8030020200923172343.9c827e52*
Red Hat Enterprise Linux 8RedHatpki-core:10.6-8030020200911215836.5ff1562f*
Red Hat Enterprise Linux 8RedHatpki-deps:10.6-8030020200527165326.30b713e6*
Red Hat Enterprise Linux 8RedHatpcs-0:0.10.10-4.el8*
Red Hat JBoss Enterprise Application Platform 7RedHatjquery*
Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8RedHateap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el8eap*
Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9RedHateap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el9eap*
Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7RedHateap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap*
Red Hat OpenShift Container Platform 3.11RedHatatomic-enterprise-service-catalog-1:3.11.170-1.git.1.91db82e.el7*
Red Hat OpenShift Container Platform 3.11RedHatatomic-openshift-0:3.11.170-1.git.0.00cac56.el7*
Red Hat OpenShift Container Platform 3.11RedHatatomic-openshift-cluster-autoscaler-0:3.11.170-1.git.1.0a0df6a.el7*
Red Hat OpenShift Container Platform 3.11RedHatatomic-openshift-descheduler-0:3.11.170-1.git.1.9ad83f2.el7*
Red Hat OpenShift Container Platform 3.11RedHatatomic-openshift-dockerregistry-0:3.11.170-1.git.1.55fab05.el7*
Red Hat OpenShift Container Platform 3.11RedHatatomic-openshift-metrics-server-0:3.11.170-1.git.1.357f177.el7*
Red Hat OpenShift Container Platform 3.11RedHatatomic-openshift-node-problem-detector-0:3.11.170-1.git.1.b1f90a6.el7*
Red Hat OpenShift Container Platform 3.11RedHatatomic-openshift-service-idler-0:3.11.170-1.git.1.8328979.el7*
Red Hat OpenShift Container Platform 3.11RedHatatomic-openshift-web-console-0:3.11.170-1.git.1.3d64e8b.el7*
Red Hat OpenShift Container Platform 3.11RedHatcri-o-0:1.11.16-0.5.dev.rhaos3.11.git3f89eba.el7*
Red Hat OpenShift Container Platform 3.11RedHatgolang-github-openshift-oauth-proxy-0:3.11.170-1.git.1.b49be83.el7*
Red Hat OpenShift Container Platform 3.11RedHatgolang-github-prometheus-alertmanager-0:3.11.170-1.git.1.61d7960.el7*
Red Hat OpenShift Container Platform 3.11RedHatgolang-github-prometheus-node_exporter-0:3.11.170-1.git.1.51473b7.el7*
Red Hat OpenShift Container Platform 3.11RedHatgolang-github-prometheus-prometheus-0:3.11.170-1.git.1.227bc98.el7*
Red Hat OpenShift Container Platform 3.11RedHatjenkins-0:2.204.2.1580891656-1.el7*
Red Hat OpenShift Container Platform 3.11RedHatjenkins-2-plugins-0:3.11.1579107288-1.el7*
Red Hat OpenShift Container Platform 3.11RedHatopenshift-ansible-0:3.11.170-2.git.5.8802564.el7*
Red Hat OpenShift Container Platform 3.11RedHatopenshift-enterprise-autoheal-0:3.11.170-1.git.1.dfe6c52.el7*
Red Hat OpenShift Container Platform 3.11RedHatopenshift-enterprise-cluster-capacity-0:3.11.170-1.git.1.661684b.el7*
Red Hat OpenShift Container Platform 3.11RedHatopenshift-kuryr-0:3.11.170-1.git.1.7265da1.el7*
Red Hat OpenShift Container Platform 4.5RedHatopenshift4/ose-console:v4.5.0-202007012112.p0*
Red Hat OpenShift Container Platform 4.6RedHatopenshift4/ose-prometheus:v4.6.0-202009290409.p0*
Red Hat OpenStack Platform 13.0 (Queens)RedHatpython-XStatic-jQuery-0:2.2.4.1-3.el7ost*
Red Hat OpenStack Platform 13.0 (Queens) for RHEL 7.6 EUSRedHatpython-XStatic-jQuery-0:2.2.4.1-3.el7ost*
Red Hat OpenStack Platform 15.0 (Stein)RedHatpython-XStatic-jQuery-0:3.4.1.0-1.el8ost*
Red Hat Single Sign-On 7RedHatkeycloak-idp-jquery*
Red Hat Single Sign-On 7.3.2 zipRedHat*
Red Hat Single Sign-On 7.6 for RHEL 7RedHatrh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso*
Red Hat Single Sign-On 7.6 for RHEL 8RedHatrh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso*
Red Hat Single Sign-On 7.6 for RHEL 9RedHatrh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso*
Red Hat Virtualization Engine 4.3RedHatovirt-engine-api-explorer-0:0.0.5-1.el7ev*
Red Hat Virtualization Engine 4.3RedHatovirt-engine-ui-extensions-0:1.0.10-1.el7ev*
Red Hat Virtualization Engine 4.3RedHatovirt-web-ui-0:1.6.0-1.el7ev*
RHEL-8 based Middleware ContainersRedHatrh-sso-7/sso76-openshift-rhel8:7.6-20*
Drupal7Ubuntutrusty*
Drupal7Ubuntutrusty/esm*
Drupal7Ubuntuxenial*
JqueryUbuntubionic*
JqueryUbuntucosmic*
JqueryUbuntudisco*
JqueryUbuntuesm-infra-legacy/trusty*
JqueryUbuntuesm-infra/bionic*
JqueryUbuntuesm-infra/xenial*
JqueryUbuntuprecise/esm*
JqueryUbuntutrusty*
JqueryUbuntutrusty/esm*
JqueryUbuntuupstream*
JqueryUbuntuxenial*
MediawikiUbuntubionic*
MediawikiUbuntufocal*
MediawikiUbuntugroovy*
MediawikiUbuntuhirsute*
MediawikiUbuntuimpish*
MediawikiUbuntukinetic*
MediawikiUbuntulunar*
MediawikiUbuntumantic*
MediawikiUbuntuoracular*
MediawikiUbuntuplucky*
MediawikiUbuntutrusty*
Node-jqueryUbuntubionic*
Node-jqueryUbuntucosmic*
Node-jqueryUbuntudisco*
Node-jqueryUbuntuesm-apps/bionic*
Node-jqueryUbuntuesm-apps/xenial*
Node-jqueryUbuntutrusty*
Node-jqueryUbuntuxenial*
Otrs2Ubuntubionic*
Otrs2Ubuntugroovy*
Otrs2Ubuntuhirsute*
Otrs2Ubuntuimpish*
Otrs2Ubuntutrusty*
Otrs2Ubuntuxenial*

Potential Mitigations

References

Aqua Security is the largest pure-play cloud native security company, providing customers the freedom to innovate and run their businesses with minimal friction. The Aqua Cloud Native Security Platform provides prevention, detection, and response automation across the entire application lifecycle to secure the build, secure cloud infrastructure and secure running workloads wherever they are deployed.
Copyright © 2026 Aqua Security Software Ltd.   Privacy Policy | Terms of Use