CVE-2019-11358 XSS in jQuery as used in Drupal, Backdrop CMS, and other products
Prototype pollution in jQuery allows attackers to inject properties into Object.prototype, potentially leading to remote code execution or privilege escalation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2019-11358?
CVE-2019-11358 is a medium-severity code injection vulnerability in Debian Debian Linux, published on 19 Apr 2019. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Object.prototype.
Weakness: CWE-1321
Which versions are affected by CVE-2019-11358?
16 open source packages ship an affected version, including django, org.webjars.npm:jquery and jQuery. It affects 105 products.
| Package | Affected | Fixed in |
|---|---|---|
django PyPI | From 2.0a1 | 2.1.9, 2.2.2 |
django PyPI | From 2.0a1 | 2.1.9 |
django PyPI | From 2.0a1 | 2.1.9 |
django PyPI | From 2.2a1 | 2.2.2 |
django PyPI | From 2.2a1 | 2.2.2 |
org.webjars.npm:jquery Maven | From 1.1.4 | 3.4.0 |
10 more packages
org.webjars.npm:jquery Maven | From 1.1.4 | 3.4.0 |
jQuery NuGet | From 1.1.4 | 3.4.0 |
jQuery NuGet | From 1.1.4 | 3.4.0 |
drupal/core Packagist | From 8.0.0 | 8.5.15, 8.6.15 |
maximebf/debugbar Packagist | All versions | 1.19.0 |
maximebf/debugbar Packagist | All versions | 1.19.0 |
jquery-rails RubyGems | All versions | 4.3.4 |
jquery-rails RubyGems | All versions | 4.3.4 |
jquery npm | From 1.1.4 | 3.4.0 |
jquery npm | From 1.1.4 | 3.4.0 |
Linux distribution packages (3)
python-XStatic-jQuery Red Hat:openstack:13::el7 | All versions | 0:2.2.4.1-3.el7ost |
python-XStatic-jQuery Red Hat:openstack:15::el8 | All versions | 0:3.4.1.0-1.el8ost |
python3-XStatic-jQuery Red Hat:openstack:15::el8 | All versions | 0:3.4.1.0-1.el8ost |
Products include Backdropcms Backdrop, Debian Debian Linux, Drupal Drupal, Fedoraproject Fedora, Joomla Joomla\!, Jquery Jquery and 99 more.
How do I fix CVE-2019-11358?
Upgrade django to a fixed version for your release line: 2.1.9 or 2.2.2.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2019-11358 being exploited?
There is no known exploitation of CVE-2019-11358 in the wild and no public exploit code.
Public exploit code: 1 Exploit-DB entry and 6 proofs of concept on GitHub.
Other vulnerabilities in Debian Debian Linux
- CVE-2021-45268 Cross-site request forgery in n/a
- CVE-2024-41709 Backdrop CMS does not sufficiently sanitize field labels before they are displayed in certain places
- CVE-2019-14769 Cross-site scripting in n/a
- CVE-2022-24590 Cross-site scripting in n/a
- CVE-2022-42094 Cross-site Scripting in Backdrop CMS
Sources
Also known as AZL-38200, AZL-40759, AZL-41809, AZL-44586, CLEANSTART-2026-YH85200, CVE-2019-5428 and 11 more.