jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Object.prototype.
CVSS Details
- CVSS 3.1 Base Score: 6.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade custodiaUpgrade python3-custodiaUpgrade python3-jwcryptoUpgrade python3-yubicoUpgrade python3-qrcode-coreUpgrade python3-kdcproxyUpgrade python3-pyusbUpgrade python3-qrcode | May 4, 2022 | Apr 20, 2019 |
| Alpine Linux | — | Upgrade drupal7Upgrade rabbitmq-server | Jun 21, 2019 | Apr 19, 2019 |
| Amazon Linux Ami 2 | — | Upgrade ipa-server-trust-adUpgrade python2-ipaserverUpgrade python2-ipaclientUpgrade pcs-snmpUpgrade ipa-client-commonUpgrade pcs-debuginfoUpgrade ipa-python-compatUpgrade ipa-clientUpgrade pcsUpgrade python2-ipalibUpgrade ipa-debuginfoUpgrade ipa-server-commonUpgrade ipa-serverUpgrade ipa-commonUpgrade ipa-server-dns | Oct 28, 2020 | Apr 20, 2019 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Apr 19, 2019 |
| Centos_linux | — | Upgrade ipa-client-commonUpgrade python3-nssUpgrade glassfish-jaxb-apiUpgrade pki-tools-debuginfoUpgrade glassfish-jaxb-runtimeUpgrade xmlstreambufferUpgrade opendnssec-debugsourceUpgrade slapi-nisUpgrade xml-commons-resolverUpgrade ldapjdkUpgrade python3-ipalibUpgrade ipa-debugsourceUpgrade pki-core-debuginfoUpgrade python3-kdcproxyUpgrade bea-stax-apiUpgrade pki-baseUpgrade softhsm-debugsourceUpgrade python2-ipalibUpgrade pki-servlet-4.0-apiUpgrade custodiaUpgrade jssUpgrade jss-debuginfoUpgrade pcs-debuginfoUpgrade opendnssecUpgrade glassfish-jaxb-coreUpgrade ipa-server-dnsUpgrade jackson-databindUpgrade pki-core-debugsourceUpgrade ipa-python-compatUpgrade ipa-server-debuginfoUpgrade pki-symkeyUpgrade python3-qrcodeUpgrade glassfish-jaxb-txw2Upgrade ipa-server-commonUpgrade javassist-javadocUpgrade ipa-client-debuginfoUpgrade ipa-healthcheck-coreUpgrade python3-qrcode-coreUpgrade python3-custodiaUpgrade pcsUpgrade javassistUpgrade python2-ipaclientUpgrade apache-commons-netUpgrade python-nss-docUpgrade jakarta-commons-httpclientUpgrade apache-commons-collectionsUpgrade python3-pyusbUpgrade softhsmUpgrade ipa-debuginfoUpgrade opendnssec-debuginfoUpgrade xerces-j2Upgrade ipa-server-trust-adUpgrade jackson-jaxrs-json-providerUpgrade ipa-selinuxUpgrade pki-serverUpgrade pki-servlet-engineUpgrade pcs-snmpUpgrade python3-yubicoUpgrade pki-base-javaUpgrade jackson-coreUpgrade slapi-nis-debuginfoUpgrade jss-javadocUpgrade python3-pkiUpgrade glassfish-fastinfosetUpgrade python2-ipaserverUpgrade ipa-clientUpgrade xalan-j2Upgrade velocityUpgrade slf4jUpgrade bind-dyndb-ldap-debuginfoUpgrade slf4j-jdk14Upgrade xml-commons-apisUpgrade softhsm-develUpgrade jackson-jaxrs-providersUpgrade ipa-commonUpgrade relaxngDatatypeUpgrade slapi-nis-debugsourceUpgrade resteasyUpgrade python3-ipaclientUpgrade python3-nss-debuginfoUpgrade apache-commons-langUpgrade jackson-module-jaxb-annotationsUpgrade pki-caUpgrade bind-dyndb-ldap-debugsourceUpgrade ipa-server-trust-ad-debuginfoUpgrade xsomUpgrade pki-toolsUpgrade stax-exUpgrade python3-ipaserverUpgrade tomcatjssUpgrade softhsm-debuginfoUpgrade pki-kraUpgrade ldapjdk-javadocUpgrade ipa-serverUpgrade python3-jwcryptoUpgrade jss-debugsourceUpgrade ipa-healthcheckUpgrade ipa-client-sambaUpgrade jackson-annotationsUpgrade python-nss-debugsourceUpgrade pki-symkey-debuginfoUpgrade bind-dyndb-ldapUpgrade ipa-client-epn | Oct 1, 2020 | Apr 20, 2019 |
| Debian | — | Upgrade otrs2Upgrade mediawikiUpgrade node-jquery | Apr 22, 2019 | Apr 19, 2019 |
| Drupal | — | Upgrade to drupal version 8.6.1Upgrade to drupal version 8.5.1Upgrade to drupal version 7.66 | Apr 23, 2019 | Apr 19, 2019 |
| Freebsd | — | Upgrade py35-django21Upgrade mediawiki132Upgrade py37-django22Upgrade py35-django22Upgrade py27-django111Upgrade py35-django111Upgrade mediawiki131Upgrade py36-django22Upgrade py36-django111Upgrade py37-django21Upgrade py36-django21Upgrade py37-django111 | Jul 5, 2019 | Jul 5, 2019 |
| Huawei Euleros 2_0_sp2 | — | Upgrade pki-toolsUpgrade pki-kraUpgrade pki-caUpgrade pki-symkeyUpgrade pki-baseUpgrade pki-server | Feb 22, 2021 | Apr 20, 2019 |
| Huawei Euleros 2_0_sp3 | — | Upgrade pki-kraUpgrade pki-serverUpgrade pki-base-javaUpgrade pki-caUpgrade pki-symkeyUpgrade pki-toolsUpgrade pki-base | Apr 30, 2021 | Apr 20, 2019 |
| Huawei Euleros 2_0_sp5 | — | Upgrade pki-baseUpgrade pki-kraUpgrade pki-serverUpgrade pki-symkeyUpgrade pki-toolsUpgrade pki-caUpgrade pki-base-java | Dec 16, 2020 | Apr 20, 2019 |
| Jquery | — | Upgrade jQuery to version 3.4.0 | Apr 24, 2019 | Apr 20, 2019 |
| Oracle Solaris | — | Upgrade consolidation/osnet/osnet-incorporation to version 11.4-11.4.24.0.1.75.3 on Solaris 11.4Upgrade library/python/django-27 to version 1.11.23-11.4.14.0.1.3.0 on Solaris 11.4Upgrade library/python/django-35 to version 1.11.23-11.4.14.0.1.3.0 on Solaris 11.4Upgrade library/python-2/django-26 to version 1.4.22-11.4.0.0.0.13.0 on Solaris 11.4Upgrade library/python-2/django to version 1.4.10-11.4.0.0.1.9.0 on Solaris 11.4Upgrade legacy/library/python/django-35 to version 1.11.29-11.4.21.0.1.69.0 on Solaris 11.4Upgrade library/python/django-26 to version 1.4.22-11.4.0.0.1.9.0 on Solaris 11.4Upgrade legacy/library/python/django-34 to version 1.11.29-11.4.21.0.1.69.0 on Solaris 11.4Upgrade library/python/django to version 1.11.23-11.4.14.0.1.3.0 on Solaris 11.4Upgrade legacy/library/python/django-27 to version 1.11.29-11.4.21.0.1.69.0 on Solaris 11.4Upgrade library/python/django-37 to version 1.11.23-11.4.14.0.1.3.0 on Solaris 11.4Upgrade network/amqp/rabbitmq to version 3.8.3-11.4.24.0.1.75.1 on Solaris 11.4Upgrade library/python-2/django-27 to version 1.4.10-11.4.0.0.1.9.0 on Solaris 11.4Upgrade library/python/django-34 to version 1.11.23-11.4.14.0.1.3.0 on Solaris 11.4 | Oct 16, 2019 | Apr 20, 2019 |
| Oracle Weblogic | — | Apply the Patch Set Update (PSU) 30108725 for version 12.1.3.0.0.Apply the Patch Set Update (PSU) 30386660 for version 12.2.1.3.0. | Oct 17, 2019 | Apr 20, 2019 |
| Oracle_linux | — | Upgrade jackson-jaxrs-json-providerUpgrade stax-exUpgrade jssUpgrade jackson-jaxrs-providersUpgrade python3-qrcodeUpgrade ipa-selinuxUpgrade python3-kdcproxyUpgrade jackson-databindUpgrade python2-ipaserverUpgrade pki-symkeyUpgrade pki-servlet-4.0-apiUpgrade pki-toolsUpgrade glassfish-jaxb-runtimeUpgrade ipa-healthcheckUpgrade xsomUpgrade xml-commons-apisUpgrade slf4j-jdk14Upgrade python3-ipaclientUpgrade custodiaUpgrade ipa-healthcheck-coreUpgrade jackson-coreUpgrade pki-kraUpgrade pki-baseUpgrade ipa-client-epnUpgrade xerces-j2Upgrade python-nss-docUpgrade python3-nssUpgrade xml-commons-resolverUpgrade pcs-snmpUpgrade pki-caUpgrade xmlstreambufferUpgrade xalan-j2Upgrade bind-dyndb-ldapUpgrade ipa-python-compatUpgrade jss-javadocUpgrade python3-ipaserverUpgrade apache-commons-collectionsUpgrade pki-serverUpgrade pcsUpgrade glassfish-fastinfosetUpgrade softhsm-develUpgrade apache-commons-netUpgrade ldapjdk-javadocUpgrade python2-ipalibUpgrade glassfish-jaxb-coreUpgrade ipa-client-commonUpgrade jackson-module-jaxb-annotationsUpgrade jackson-annotationsUpgrade python3-jwcryptoUpgrade ipa-server-commonUpgrade ipa-clientUpgrade pki-base-javaUpgrade bea-stax-apiUpgrade ipa-server-trust-adUpgrade opendnssecUpgrade velocityUpgrade jakarta-commons-httpclientUpgrade pki-servlet-engineUpgrade slf4jUpgrade python3-pkiUpgrade glassfish-jaxb-apiUpgrade tomcatjssUpgrade resteasyUpgrade python3-yubicoUpgrade python2-ipaclientUpgrade slapi-nisUpgrade glassfish-jaxb-txw2Upgrade python3-qrcode-coreUpgrade ipa-commonUpgrade ldapjdkUpgrade javassist-javadocUpgrade python3-pyusbUpgrade python3-ipalibUpgrade ipa-serverUpgrade ipa-client-sambaUpgrade apache-commons-langUpgrade softhsmUpgrade python3-custodiaUpgrade relaxngDatatypeUpgrade javassistUpgrade ipa-server-dns | Oct 7, 2020 | Mar 27, 2019 |
| Pulse Secure Pulse Connect Secure | — | Update Pulse Connect Secure to version 9.1R9 | Oct 28, 2020 | Apr 20, 2019 |
| Red Hat Jboss Eap | — | Upgrade Red Hat JBoss EAP to the latest version | Sep 19, 2024 | Mar 27, 2019 |
| Red_hat Jboss_eap | — | — | Apr 10, 2023 | Apr 20, 2019 |
| Redhat Openshift | — | Upgrade openshift-ansibleUpgrade atomic-openshift-dockerregistryUpgrade golang-github-prometheus-alertmanagerUpgrade atomic-openshift-service-idlerUpgrade golang-github-prometheus-node_exporterUpgrade jenkinsUpgrade openshift-enterprise-autohealUpgrade atomic-enterprise-service-catalogUpgrade openshift-enterprise-cluster-capacityUpgrade cri-oUpgrade atomic-openshift-cluster-autoscalerUpgrade golang-github-openshift-oauth-proxyUpgrade jenkins-2-pluginsUpgrade golang-github-prometheus-prometheusUpgrade atomic-openshift-metrics-serverUpgrade openshift-kuryrUpgrade atomic-openshift-node-problem-detectorUpgrade atomic-openshiftUpgrade atomic-openshift-deschedulerUpgrade atomic-openshift-web-console | Dec 29, 2020 | Mar 27, 2019 |
| Redhat_linux | — | Upgrade slapi-nis-debuginfoUpgrade velocityUpgrade tomcatjssUpgrade stax-exUpgrade jss-javadocUpgrade glassfish-jaxb-coreUpgrade ipa-python-compatUpgrade pki-base-javaUpgrade ldapjdk-javadocUpgrade python2-ipaclientUpgrade javassistUpgrade opendnssecUpgrade ipa-server-debuginfoUpgrade ipa-server-dnsUpgrade xml-commons-apisUpgrade ipa-clientUpgrade ipa-debuginfoUpgrade ipa-serverUpgrade ipa-client-commonUpgrade pcs-snmpNo solution existsUpgrade softhsm-develUpgrade jackson-jaxrs-providersUpgrade python3-custodiaUpgrade pki-symkey-debuginfoUpgrade jakarta-commons-httpclientUpgrade python3-pyusbUpgrade pki-tools-debuginfoUpgrade glassfish-fastinfosetUpgrade jackson-module-jaxb-annotationsUpgrade xmlstreambufferUpgrade ipa-server-trust-adUpgrade python3-yubicoUpgrade python3-ipaserverUpgrade softhsmUpgrade softhsm-debugsourceUpgrade slapi-nisUpgrade opendnssec-debuginfoUpgrade ipa-client-debuginfoUpgrade xerces-j2Upgrade ldapjdkUpgrade slf4j-jdk14Upgrade resteasyUpgrade glassfish-jaxb-apiUpgrade python3-qrcode-coreUpgrade python3-jwcryptoUpgrade slapi-nis-debugsourceUpgrade ipa-commonUpgrade bind-dyndb-ldap-debuginfoUpgrade pki-servlet-engineUpgrade ipa-client-epnUpgrade python3-pkiUpgrade apache-commons-langUpgrade bea-stax-apiUpgrade python2-ipalibUpgrade ipa-server-trust-ad-debuginfoUpgrade python2-ipaserverUpgrade pki-servlet-4.0-apiUpgrade python-nss-docUpgrade pcs-debuginfoUpgrade ipa-selinuxUpgrade custodiaUpgrade jss-debuginfoUpgrade pki-caUpgrade bind-dyndb-ldap-debugsourceUpgrade jackson-jaxrs-json-providerUpgrade pki-serverUpgrade python-nss-debugsourceUpgrade pki-core-debugsourceUpgrade jssUpgrade glassfish-jaxb-txw2Upgrade ipa-healthcheckUpgrade ipa-client-sambaUpgrade pki-kraUpgrade python3-nssUpgrade python3-ipaclientUpgrade pcsUpgrade python3-ipalibUpgrade xsomUpgrade python3-qrcodeUpgrade apache-commons-netUpgrade pki-baseUpgrade slf4jUpgrade softhsm-debuginfoUpgrade xalan-j2Upgrade pki-toolsUpgrade javassist-javadocUpgrade pki-symkeyUpgrade python3-kdcproxyUpgrade jackson-annotationsUpgrade jackson-coreUpgrade ipa-debugsourceUpgrade glassfish-jaxb-runtimeUpgrade relaxngDatatypeUpgrade pki-core-debuginfoUpgrade opendnssec-debugsourceUpgrade python3-nss-debuginfoUpgrade jss-debugsourceUpgrade ipa-healthcheck-coreUpgrade jackson-databindUpgrade apache-commons-collectionsUpgrade bind-dyndb-ldapUpgrade xml-commons-resolverUpgrade ipa-server-common | Oct 1, 2020 | Apr 20, 2019 |
| Rocky_linux | — | Upgrade python3-nssUpgrade python-nss-docUpgrade pcsUpgrade python-nss-debugsourceUpgrade pcs-snmpUpgrade python3-nss-debuginfo | Mar 12, 2024 | Apr 20, 2019 |
| Suse | — | Upgrade python3-django | Aug 9, 2019 | Apr 19, 2019 |
| Ubuntu | — | Upgrade libjs-jquery (Ubuntu Pro) | Jun 26, 2025 | Apr 20, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub