jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Object.prototype.
CVSS Details
- CVSS 3.1 Base Score: 6.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade python3-pyusbUpgrade python3-kdcproxyUpgrade python3-qrcodeUpgrade python3-custodiaUpgrade python3-yubicoUpgrade custodiaUpgrade python3-jwcryptoUpgrade python3-qrcode-core | May 4, 2022 | Apr 20, 2019 |
| Alpine Linux | — | Upgrade rabbitmq-serverUpgrade drupal7 | Jun 21, 2019 | Apr 19, 2019 |
| Amazon Linux Ami 2 | — | Upgrade python2-ipaclientUpgrade ipa-server-trust-adUpgrade python2-ipaserverUpgrade ipa-server-commonUpgrade python2-ipalibUpgrade ipa-client-commonUpgrade ipa-python-compatUpgrade ipa-commonUpgrade ipa-serverUpgrade ipa-clientUpgrade pcs-snmpUpgrade pcsUpgrade ipa-server-dnsUpgrade pcs-debuginfoUpgrade ipa-debuginfo | Oct 28, 2020 | Apr 20, 2019 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Apr 19, 2019 |
| Centos_linux | — | Upgrade ipa-server-debuginfoUpgrade jss-debuginfoUpgrade ipa-client-commonUpgrade javassistUpgrade python3-pyusbUpgrade python-nss-docUpgrade python3-qrcodeUpgrade glassfish-jaxb-apiUpgrade python3-ipaclientUpgrade jackson-module-jaxb-annotationsUpgrade ipa-clientUpgrade relaxngDatatypeUpgrade pki-servlet-engineUpgrade pki-base-javaUpgrade jackson-annotationsUpgrade softhsm-develUpgrade bind-dyndb-ldapUpgrade ipa-commonUpgrade pcs-snmpUpgrade slf4j-jdk14Upgrade tomcatjssUpgrade ipa-client-sambaUpgrade pki-caUpgrade pki-kraUpgrade ipa-server-trust-ad-debuginfoUpgrade python3-jwcryptoUpgrade jackson-jaxrs-providersUpgrade stax-exUpgrade jackson-jaxrs-json-providerUpgrade softhsm-debuginfoUpgrade slapi-nis-debugsourceUpgrade ipa-serverUpgrade ipa-healthcheckUpgrade python2-ipaserverUpgrade apache-commons-langUpgrade python3-ipaserverUpgrade pki-serverUpgrade jss-javadocUpgrade python3-nss-debuginfoUpgrade bind-dyndb-ldap-debuginfoUpgrade xalan-j2Upgrade glassfish-fastinfosetUpgrade python3-pkiUpgrade python-nss-debugsourceUpgrade velocityUpgrade xml-commons-apisUpgrade resteasyUpgrade jss-debugsourceUpgrade xsomUpgrade bind-dyndb-ldap-debugsourceUpgrade ipa-selinuxUpgrade pki-toolsUpgrade ldapjdk-javadocUpgrade slapi-nis-debuginfoUpgrade ipa-client-epnUpgrade pki-symkey-debuginfoUpgrade python3-yubicoUpgrade jackson-coreUpgrade slf4jUpgrade softhsm-debugsourceUpgrade python2-ipalibUpgrade ipa-server-trust-adUpgrade custodiaUpgrade jssUpgrade pki-servlet-4.0-apiUpgrade xml-commons-resolverUpgrade softhsmUpgrade glassfish-jaxb-runtimeUpgrade opendnssec-debugsourceUpgrade ipa-client-debuginfoUpgrade glassfish-jaxb-txw2Upgrade ipa-server-commonUpgrade python3-nssUpgrade python2-ipaclientUpgrade pcsUpgrade pki-symkeyUpgrade python3-qrcode-coreUpgrade apache-commons-netUpgrade opendnssec-debuginfoUpgrade xerces-j2Upgrade xmlstreambufferUpgrade python3-custodiaUpgrade opendnssecUpgrade ipa-healthcheck-coreUpgrade ipa-debuginfoUpgrade ipa-python-compatUpgrade javassist-javadocUpgrade apache-commons-collectionsUpgrade python3-ipalibUpgrade jakarta-commons-httpclientUpgrade glassfish-jaxb-coreUpgrade jackson-databindUpgrade ldapjdkUpgrade ipa-debugsourceUpgrade slapi-nisUpgrade ipa-server-dnsUpgrade pki-core-debugsourceUpgrade pki-tools-debuginfoUpgrade pki-core-debuginfoUpgrade pcs-debuginfoUpgrade python3-kdcproxyUpgrade bea-stax-apiUpgrade pki-base | Oct 1, 2020 | Apr 20, 2019 |
| Debian | — | Upgrade node-jqueryUpgrade mediawikiUpgrade otrs2 | Apr 22, 2019 | Apr 19, 2019 |
| Drupal | — | Upgrade to drupal version 7.66Upgrade to drupal version 8.6.1Upgrade to drupal version 8.5.1 | Apr 23, 2019 | Apr 19, 2019 |
| Freebsd | — | Upgrade mediawiki132Upgrade py27-django111Upgrade py35-django21Upgrade py37-django22Upgrade py35-django22Upgrade py37-django111Upgrade py36-django22Upgrade mediawiki131Upgrade py36-django21Upgrade py35-django111Upgrade py36-django111Upgrade py37-django21 | Jul 5, 2019 | Jul 5, 2019 |
| Huawei Euleros 2_0_sp2 | — | Upgrade pki-kraUpgrade pki-toolsUpgrade pki-baseUpgrade pki-caUpgrade pki-symkeyUpgrade pki-server | Feb 22, 2021 | Apr 20, 2019 |
| Huawei Euleros 2_0_sp3 | — | Upgrade pki-toolsUpgrade pki-symkeyUpgrade pki-kraUpgrade pki-caUpgrade pki-base-javaUpgrade pki-serverUpgrade pki-base | Apr 30, 2021 | Apr 20, 2019 |
| Huawei Euleros 2_0_sp5 | — | Upgrade pki-toolsUpgrade pki-serverUpgrade pki-kraUpgrade pki-base-javaUpgrade pki-symkeyUpgrade pki-caUpgrade pki-base | Dec 16, 2020 | Apr 20, 2019 |
| Jquery | — | Upgrade jQuery to version 3.4.0 | Apr 24, 2019 | Apr 20, 2019 |
| Oracle Solaris | — | Upgrade library/python-2/django-27 to version 1.4.10-11.4.0.0.1.9.0 on Solaris 11.4Upgrade library/python/django-34 to version 1.11.23-11.4.14.0.1.3.0 on Solaris 11.4Upgrade network/amqp/rabbitmq to version 3.8.3-11.4.24.0.1.75.1 on Solaris 11.4Upgrade library/python/django-37 to version 1.11.23-11.4.14.0.1.3.0 on Solaris 11.4Upgrade library/python/django-26 to version 1.4.22-11.4.0.0.1.9.0 on Solaris 11.4Upgrade legacy/library/python/django-27 to version 1.11.29-11.4.21.0.1.69.0 on Solaris 11.4Upgrade library/python/django-27 to version 1.11.23-11.4.14.0.1.3.0 on Solaris 11.4Upgrade library/python/django-35 to version 1.11.23-11.4.14.0.1.3.0 on Solaris 11.4Upgrade library/python-2/django-26 to version 1.4.22-11.4.0.0.0.13.0 on Solaris 11.4Upgrade consolidation/osnet/osnet-incorporation to version 11.4-11.4.24.0.1.75.3 on Solaris 11.4Upgrade library/python-2/django to version 1.4.10-11.4.0.0.1.9.0 on Solaris 11.4Upgrade library/python/django to version 1.11.23-11.4.14.0.1.3.0 on Solaris 11.4Upgrade legacy/library/python/django-34 to version 1.11.29-11.4.21.0.1.69.0 on Solaris 11.4Upgrade legacy/library/python/django-35 to version 1.11.29-11.4.21.0.1.69.0 on Solaris 11.4 | Oct 16, 2019 | Apr 20, 2019 |
| Oracle Weblogic | — | Apply the Patch Set Update (PSU) 30108725 for version 12.1.3.0.0.Apply the Patch Set Update (PSU) 30386660 for version 12.2.1.3.0. | Oct 17, 2019 | Apr 20, 2019 |
| Oracle_linux | — | Upgrade xerces-j2Upgrade custodiaUpgrade xml-commons-resolverUpgrade jackson-jaxrs-json-providerUpgrade ipa-selinuxUpgrade jackson-jaxrs-providersUpgrade stax-exUpgrade pki-symkeyUpgrade python3-kdcproxyUpgrade ipa-healthcheckUpgrade pki-kraUpgrade python3-ipaclientUpgrade pki-baseUpgrade xsomUpgrade xml-commons-apisUpgrade python2-ipaserverUpgrade jssUpgrade pki-toolsUpgrade jackson-databindUpgrade ipa-healthcheck-coreUpgrade pki-caUpgrade jackson-coreUpgrade python3-nssUpgrade pcs-snmpUpgrade python-nss-docUpgrade xmlstreambufferUpgrade slf4j-jdk14Upgrade glassfish-jaxb-runtimeUpgrade ipa-client-epnUpgrade pki-servlet-4.0-apiUpgrade python3-qrcodeUpgrade ipa-server-dnsUpgrade xalan-j2Upgrade ldapjdk-javadocUpgrade python2-ipalibUpgrade ipa-server-trust-adUpgrade tomcatjssUpgrade softhsmUpgrade glassfish-jaxb-txw2Upgrade slapi-nisUpgrade python2-ipaclientUpgrade resteasyUpgrade opendnssecUpgrade ldapjdkUpgrade pki-servlet-engineUpgrade javassist-javadocUpgrade slf4jUpgrade velocityUpgrade python3-pkiUpgrade glassfish-jaxb-apiUpgrade javassistUpgrade softhsm-develUpgrade relaxngDatatypeUpgrade pki-serverUpgrade python3-custodiaUpgrade bind-dyndb-ldapUpgrade apache-commons-collectionsUpgrade apache-commons-netUpgrade ipa-python-compatUpgrade jackson-module-jaxb-annotationsUpgrade jakarta-commons-httpclientUpgrade bea-stax-apiUpgrade ipa-commonUpgrade ipa-serverUpgrade glassfish-fastinfosetUpgrade pcsUpgrade jackson-annotationsUpgrade ipa-clientUpgrade ipa-client-sambaUpgrade python3-qrcode-coreUpgrade python3-jwcryptoUpgrade pki-base-javaUpgrade python3-ipalibUpgrade jss-javadocUpgrade ipa-server-commonUpgrade ipa-client-commonUpgrade python3-yubicoUpgrade python3-ipaserverUpgrade apache-commons-langUpgrade python3-pyusbUpgrade glassfish-jaxb-core | Oct 7, 2020 | Mar 27, 2019 |
| Pulse Secure Pulse Connect Secure | — | Update Pulse Connect Secure to version 9.1R9 | Oct 28, 2020 | Apr 20, 2019 |
| Red Hat Jboss Eap | — | Upgrade Red Hat JBoss EAP to the latest version | Sep 19, 2024 | Mar 27, 2019 |
| Red_hat Jboss_eap | — | — | Apr 10, 2023 | Apr 20, 2019 |
| Redhat Openshift | — | Upgrade atomic-openshiftUpgrade atomic-enterprise-service-catalogUpgrade jenkins-2-pluginsUpgrade atomic-openshift-cluster-autoscalerUpgrade openshift-enterprise-cluster-capacityUpgrade atomic-openshift-web-consoleUpgrade openshift-kuryrUpgrade golang-github-prometheus-prometheusUpgrade atomic-openshift-deschedulerUpgrade golang-github-openshift-oauth-proxyUpgrade atomic-openshift-metrics-serverUpgrade cri-oUpgrade atomic-openshift-node-problem-detectorUpgrade jenkinsUpgrade openshift-enterprise-autohealUpgrade atomic-openshift-service-idlerUpgrade atomic-openshift-dockerregistryUpgrade golang-github-prometheus-node_exporterUpgrade golang-github-prometheus-alertmanagerUpgrade openshift-ansible | Dec 29, 2020 | Mar 27, 2019 |
| Redhat_linux | — | Upgrade bind-dyndb-ldap-debugsourceUpgrade javassist-javadocUpgrade pki-toolsUpgrade custodiaUpgrade xalan-j2Upgrade jackson-coreUpgrade pki-core-debuginfoUpgrade python2-ipaserverUpgrade relaxngDatatypeUpgrade python3-ipalibUpgrade python-nss-debugsourceUpgrade jackson-jaxrs-json-providerUpgrade glassfish-jaxb-runtimeUpgrade jackson-annotationsUpgrade pki-core-debugsourceUpgrade python3-kdcproxyUpgrade ipa-selinuxUpgrade ipa-healthcheckUpgrade softhsm-debuginfoUpgrade ipa-server-commonUpgrade pcsUpgrade jssUpgrade pki-servlet-4.0-apiUpgrade ipa-debugsourceUpgrade python3-nssUpgrade ipa-server-trust-ad-debuginfoUpgrade glassfish-jaxb-txw2Upgrade pki-kraUpgrade slf4jUpgrade pki-serverUpgrade jackson-databindUpgrade xsomUpgrade jss-debuginfoUpgrade pki-symkeyUpgrade python3-nss-debuginfoUpgrade bind-dyndb-ldapUpgrade ipa-client-sambaUpgrade apache-commons-netUpgrade pki-baseUpgrade jss-debugsourceUpgrade ipa-healthcheck-coreUpgrade opendnssec-debugsourceUpgrade pcs-debuginfoUpgrade python-nss-docUpgrade python3-ipaclientUpgrade python3-qrcodeUpgrade xml-commons-resolverUpgrade pki-caUpgrade xmlstreambufferUpgrade slapi-nisUpgrade glassfish-jaxb-coreUpgrade ipa-server-trust-adUpgrade bind-dyndb-ldap-debuginfoUpgrade softhsmUpgrade ipa-clientUpgrade slf4j-jdk14Upgrade xml-commons-apisUpgrade python3-pkiUpgrade slapi-nis-debugsourceUpgrade velocityUpgrade pki-servlet-engineUpgrade python3-qrcode-coreUpgrade apache-commons-langUpgrade ipa-client-debuginfoUpgrade slapi-nis-debuginfoUpgrade ldapjdkUpgrade softhsm-develUpgrade glassfish-jaxb-apiUpgrade ipa-serverUpgrade pcs-snmpUpgrade jackson-jaxrs-providersUpgrade python3-custodiaUpgrade ipa-client-commonUpgrade opendnssec-debuginfoUpgrade python2-ipalibUpgrade ipa-commonUpgrade tomcatjssUpgrade jss-javadocUpgrade resteasyUpgrade ipa-client-epnUpgrade python3-pyusbUpgrade pki-base-javaUpgrade ipa-server-dnsUpgrade python2-ipaclientUpgrade bea-stax-apiUpgrade pki-symkey-debuginfoUpgrade stax-exUpgrade jackson-module-jaxb-annotationsUpgrade xerces-j2Upgrade ldapjdk-javadocUpgrade python3-jwcryptoUpgrade javassistNo solution existsUpgrade ipa-python-compatUpgrade opendnssecUpgrade ipa-debuginfoUpgrade python3-ipaserverUpgrade pki-tools-debuginfoUpgrade python3-yubicoUpgrade softhsm-debugsourceUpgrade jakarta-commons-httpclientUpgrade ipa-server-debuginfoUpgrade glassfish-fastinfosetUpgrade apache-commons-collections | Oct 1, 2020 | Apr 20, 2019 |
| Rocky_linux | — | Upgrade python-nss-docUpgrade pcsUpgrade python3-nssUpgrade python-nss-debugsourceUpgrade pcs-snmpUpgrade python3-nss-debuginfo | Mar 12, 2024 | Apr 20, 2019 |
| Suse | — | Upgrade python3-django | Aug 9, 2019 | Apr 19, 2019 |
| Ubuntu | — | Upgrade libjs-jquery (Ubuntu Pro) | Jun 26, 2025 | Apr 20, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub