jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Object.prototype.
CVSS Details
- CVSS 3.1 Base Score: 6.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade python3-kdcproxyUpgrade python3-pyusbUpgrade python3-qrcodeUpgrade custodiaUpgrade python3-yubicoUpgrade python3-qrcode-coreUpgrade python3-custodiaUpgrade python3-jwcrypto | May 4, 2022 | Apr 20, 2019 |
| Alpine Linux | — | Upgrade rabbitmq-serverUpgrade drupal7 | Jun 21, 2019 | Apr 19, 2019 |
| Amazon Linux Ami 2 | — | Upgrade ipa-commonUpgrade ipa-serverUpgrade ipa-client-commonUpgrade pcs-snmpUpgrade pcs-debuginfoUpgrade ipa-server-dnsUpgrade ipa-python-compatUpgrade ipa-clientUpgrade ipa-debuginfoUpgrade ipa-server-commonUpgrade pcsUpgrade python2-ipalibUpgrade python2-ipaserverUpgrade python2-ipaclientUpgrade ipa-server-trust-ad | Oct 28, 2020 | Apr 20, 2019 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Apr 19, 2019 |
| Centos_linux | — | Upgrade pki-core-debugsourceUpgrade slapi-nisUpgrade pki-tools-debuginfoUpgrade ipa-server-trust-adUpgrade ldapjdkUpgrade xmlstreambufferUpgrade ipa-debugsourceUpgrade python3-custodiaUpgrade glassfish-jaxb-apiUpgrade python3-nssUpgrade glassfish-jaxb-txw2Upgrade softhsm-debugsourceUpgrade pki-symkeyUpgrade opendnssec-debuginfoUpgrade python3-pyusbUpgrade javassist-javadocUpgrade xml-commons-resolverUpgrade ipa-server-commonUpgrade apache-commons-collectionsUpgrade pki-baseUpgrade ipa-python-compatUpgrade ipa-debuginfoUpgrade jssUpgrade ipa-server-dnsUpgrade opendnssecUpgrade jackson-databindUpgrade ipa-server-debuginfoUpgrade python3-qrcode-coreUpgrade pcs-debuginfoUpgrade custodiaUpgrade jss-debuginfoUpgrade pki-servlet-4.0-apiUpgrade python2-ipalibUpgrade pki-core-debuginfoUpgrade pcsUpgrade python-nss-docUpgrade glassfish-jaxb-coreUpgrade glassfish-jaxb-runtimeUpgrade xerces-j2Upgrade python3-kdcproxyUpgrade jakarta-commons-httpclientUpgrade bea-stax-apiUpgrade python2-ipaclientUpgrade softhsmUpgrade python3-ipalibUpgrade ipa-client-debuginfoUpgrade javassistUpgrade ipa-healthcheck-coreUpgrade python3-qrcodeUpgrade ipa-client-commonUpgrade apache-commons-netUpgrade opendnssec-debugsourceUpgrade python3-nss-debuginfoUpgrade softhsm-debuginfoUpgrade jackson-jaxrs-providersUpgrade ipa-commonUpgrade slapi-nis-debuginfoUpgrade jackson-coreUpgrade pki-symkey-debuginfoUpgrade pcs-snmpUpgrade pki-serverUpgrade ipa-client-epnUpgrade slf4jUpgrade glassfish-fastinfosetUpgrade python3-ipaserverUpgrade jss-debugsourceUpgrade ldapjdk-javadocUpgrade jackson-annotationsUpgrade ipa-serverUpgrade velocityUpgrade python3-pkiUpgrade jackson-jaxrs-json-providerUpgrade jackson-module-jaxb-annotationsUpgrade ipa-server-trust-ad-debuginfoUpgrade pki-toolsUpgrade resteasyUpgrade relaxngDatatypeUpgrade python3-ipaclientUpgrade xsomUpgrade bind-dyndb-ldap-debugsourceUpgrade pki-caUpgrade apache-commons-langUpgrade ipa-selinuxUpgrade slapi-nis-debugsourceUpgrade stax-exUpgrade ipa-client-sambaUpgrade pki-kraUpgrade python3-jwcryptoUpgrade tomcatjssUpgrade python2-ipaserverUpgrade ipa-healthcheckUpgrade python3-yubicoUpgrade bind-dyndb-ldapUpgrade pki-servlet-engineUpgrade python-nss-debugsourceUpgrade pki-base-javaUpgrade xalan-j2Upgrade jss-javadocUpgrade ipa-clientUpgrade softhsm-develUpgrade slf4j-jdk14Upgrade bind-dyndb-ldap-debuginfoUpgrade xml-commons-apis | Oct 1, 2020 | Apr 20, 2019 |
| Debian | — | Upgrade node-jqueryUpgrade mediawikiUpgrade otrs2 | Apr 22, 2019 | Apr 19, 2019 |
| Drupal | — | Upgrade to drupal version 7.66Upgrade to drupal version 8.6.1Upgrade to drupal version 8.5.1 | Apr 23, 2019 | Apr 19, 2019 |
| Freebsd | — | Upgrade py37-django22Upgrade py35-django21Upgrade mediawiki132Upgrade py35-django22Upgrade py27-django111Upgrade py35-django111Upgrade py36-django21Upgrade py36-django22Upgrade py36-django111Upgrade py37-django111Upgrade mediawiki131Upgrade py37-django21 | Jul 5, 2019 | Jul 5, 2019 |
| Huawei Euleros 2_0_sp2 | — | Upgrade pki-kraUpgrade pki-toolsUpgrade pki-baseUpgrade pki-symkeyUpgrade pki-caUpgrade pki-server | Feb 22, 2021 | Apr 20, 2019 |
| Huawei Euleros 2_0_sp3 | — | Upgrade pki-baseUpgrade pki-symkeyUpgrade pki-base-javaUpgrade pki-serverUpgrade pki-toolsUpgrade pki-caUpgrade pki-kra | Apr 30, 2021 | Apr 20, 2019 |
| Huawei Euleros 2_0_sp5 | — | Upgrade pki-base-javaUpgrade pki-toolsUpgrade pki-serverUpgrade pki-symkeyUpgrade pki-caUpgrade pki-kraUpgrade pki-base | Dec 16, 2020 | Apr 20, 2019 |
| Jquery | — | Upgrade jQuery to version 3.4.0 | Apr 24, 2019 | Apr 20, 2019 |
| Oracle Solaris | — | Upgrade library/python/django-35 to version 1.11.23-11.4.14.0.1.3.0 on Solaris 11.4Upgrade library/python-2/django-26 to version 1.4.22-11.4.0.0.0.13.0 on Solaris 11.4Upgrade consolidation/osnet/osnet-incorporation to version 11.4-11.4.24.0.1.75.3 on Solaris 11.4Upgrade library/python-2/django to version 1.4.10-11.4.0.0.1.9.0 on Solaris 11.4Upgrade library/python/django to version 1.11.23-11.4.14.0.1.3.0 on Solaris 11.4Upgrade legacy/library/python/django-27 to version 1.11.29-11.4.21.0.1.69.0 on Solaris 11.4Upgrade library/python/django-27 to version 1.11.23-11.4.14.0.1.3.0 on Solaris 11.4Upgrade legacy/library/python/django-34 to version 1.11.29-11.4.21.0.1.69.0 on Solaris 11.4Upgrade library/python/django-26 to version 1.4.22-11.4.0.0.1.9.0 on Solaris 11.4Upgrade legacy/library/python/django-35 to version 1.11.29-11.4.21.0.1.69.0 on Solaris 11.4Upgrade library/python/django-34 to version 1.11.23-11.4.14.0.1.3.0 on Solaris 11.4Upgrade library/python-2/django-27 to version 1.4.10-11.4.0.0.1.9.0 on Solaris 11.4Upgrade library/python/django-37 to version 1.11.23-11.4.14.0.1.3.0 on Solaris 11.4Upgrade network/amqp/rabbitmq to version 3.8.3-11.4.24.0.1.75.1 on Solaris 11.4 | Oct 16, 2019 | Apr 20, 2019 |
| Oracle Weblogic | — | Apply the Patch Set Update (PSU) 30108725 for version 12.1.3.0.0.Apply the Patch Set Update (PSU) 30386660 for version 12.2.1.3.0. | Oct 17, 2019 | Apr 20, 2019 |
| Oracle_linux | — | Upgrade xml-commons-apisUpgrade custodiaUpgrade xmlstreambufferUpgrade python3-ipaclientUpgrade xsomUpgrade python-nss-docUpgrade ipa-healthcheckUpgrade pki-toolsUpgrade pki-symkeyUpgrade glassfish-jaxb-runtimeUpgrade python2-ipaserverUpgrade xml-commons-resolverUpgrade python3-nssUpgrade jackson-jaxrs-json-providerUpgrade pki-baseUpgrade jackson-jaxrs-providersUpgrade stax-exUpgrade ipa-selinuxUpgrade jackson-coreUpgrade pcs-snmpUpgrade pki-caUpgrade pki-servlet-4.0-apiUpgrade jssUpgrade pki-kraUpgrade python3-qrcodeUpgrade python3-kdcproxyUpgrade slf4j-jdk14Upgrade xerces-j2Upgrade jackson-databindUpgrade ipa-client-epnUpgrade ipa-healthcheck-coreUpgrade pki-serverUpgrade pcsUpgrade resteasyUpgrade python3-pkiUpgrade ipa-python-compatUpgrade jackson-module-jaxb-annotationsUpgrade pki-servlet-engineUpgrade glassfish-jaxb-coreUpgrade ldapjdk-javadocUpgrade opendnssecUpgrade python2-ipalibUpgrade jakarta-commons-httpclientUpgrade python3-custodiaUpgrade javassistUpgrade softhsm-develUpgrade relaxngDatatypeUpgrade apache-commons-collectionsUpgrade pki-base-javaUpgrade jackson-annotationsUpgrade ipa-server-commonUpgrade python3-qrcode-coreUpgrade python3-ipaserverUpgrade python3-jwcryptoUpgrade bind-dyndb-ldapUpgrade xalan-j2Upgrade ipa-server-dnsUpgrade jss-javadocUpgrade apache-commons-netUpgrade python3-ipalibUpgrade ipa-client-commonUpgrade ipa-serverUpgrade ipa-client-sambaUpgrade ipa-clientUpgrade ipa-commonUpgrade python3-pyusbUpgrade python2-ipaclientUpgrade glassfish-jaxb-txw2Upgrade ipa-server-trust-adUpgrade javassist-javadocUpgrade glassfish-fastinfosetUpgrade softhsmUpgrade tomcatjssUpgrade ldapjdkUpgrade slapi-nisUpgrade bea-stax-apiUpgrade apache-commons-langUpgrade velocityUpgrade glassfish-jaxb-apiUpgrade python3-yubicoUpgrade slf4j | Oct 7, 2020 | Mar 27, 2019 |
| Pulse Secure Pulse Connect Secure | — | Update Pulse Connect Secure to version 9.1R9 | Oct 28, 2020 | Apr 20, 2019 |
| Red Hat Jboss Eap | — | Upgrade Red Hat JBoss EAP to the latest version | Sep 19, 2024 | Mar 27, 2019 |
| Red_hat Jboss_eap | — | — | Apr 10, 2023 | Apr 20, 2019 |
| Redhat Openshift | — | Upgrade atomic-openshiftUpgrade openshift-enterprise-cluster-capacityUpgrade atomic-openshift-metrics-serverUpgrade atomic-openshift-web-consoleUpgrade atomic-openshift-node-problem-detectorUpgrade golang-github-openshift-oauth-proxyUpgrade jenkins-2-pluginsUpgrade openshift-kuryrUpgrade cri-oUpgrade golang-github-prometheus-prometheusUpgrade atomic-openshift-cluster-autoscalerUpgrade atomic-openshift-deschedulerUpgrade atomic-enterprise-service-catalogUpgrade jenkinsUpgrade golang-github-prometheus-alertmanagerUpgrade atomic-openshift-service-idlerUpgrade golang-github-prometheus-node_exporterUpgrade atomic-openshift-dockerregistryUpgrade openshift-ansibleUpgrade openshift-enterprise-autoheal | Dec 29, 2020 | Mar 27, 2019 |
| Redhat_linux | — | Upgrade ipa-selinuxUpgrade pki-serverUpgrade ipa-debugsourceUpgrade softhsm-debuginfoUpgrade pki-kraUpgrade python3-nssUpgrade jss-debuginfoUpgrade ipa-server-commonUpgrade pcsUpgrade jssUpgrade pki-servlet-4.0-apiUpgrade pki-symkeyUpgrade ipa-server-trust-ad-debuginfoUpgrade python3-nss-debuginfoUpgrade pki-core-debuginfoUpgrade python3-ipaclientUpgrade python3-ipalibUpgrade bind-dyndb-ldap-debugsourceUpgrade python3-qrcodeUpgrade jackson-coreUpgrade ipa-healthcheck-coreUpgrade jackson-jaxrs-json-providerUpgrade ipa-client-sambaUpgrade apache-commons-netUpgrade xsomUpgrade glassfish-jaxb-txw2Upgrade python-nss-docUpgrade python-nss-debugsourceUpgrade jss-debugsourceUpgrade glassfish-jaxb-runtimeUpgrade pki-baseUpgrade python2-ipaserverUpgrade jackson-annotationsUpgrade python3-kdcproxyUpgrade custodiaUpgrade xml-commons-resolverUpgrade xalan-j2Upgrade bind-dyndb-ldapUpgrade apache-commons-collectionsUpgrade opendnssec-debugsourceUpgrade slf4jUpgrade pki-caUpgrade javassist-javadocUpgrade pcs-debuginfoUpgrade pki-toolsUpgrade pki-core-debugsourceUpgrade relaxngDatatypeUpgrade jackson-databindUpgrade ipa-healthcheckUpgrade ipa-client-epnUpgrade jackson-module-jaxb-annotationsUpgrade bea-stax-apiUpgrade opendnssecUpgrade python2-ipalibUpgrade ipa-python-compatUpgrade xml-commons-apisUpgrade ipa-debuginfoUpgrade ipa-server-dnsUpgrade jss-javadocUpgrade pki-symkey-debuginfoUpgrade python3-pyusbUpgrade softhsm-develUpgrade python3-custodiaUpgrade ipa-client-commonUpgrade python3-qrcode-coreUpgrade jakarta-commons-httpclientUpgrade ipa-server-debuginfoUpgrade python2-ipaclientUpgrade bind-dyndb-ldap-debuginfoUpgrade softhsmUpgrade glassfish-jaxb-coreUpgrade xerces-j2Upgrade apache-commons-langUpgrade python3-jwcryptoUpgrade opendnssec-debuginfoUpgrade ipa-client-debuginfoUpgrade slapi-nis-debuginfoUpgrade jackson-jaxrs-providersUpgrade ldapjdk-javadocUpgrade ipa-serverUpgrade pki-base-javaUpgrade javassistUpgrade ldapjdkUpgrade python3-pkiUpgrade glassfish-jaxb-apiUpgrade pki-servlet-engineUpgrade resteasyUpgrade slapi-nis-debugsourceUpgrade velocityUpgrade slf4j-jdk14Upgrade python3-ipaserverUpgrade tomcatjssUpgrade ipa-commonUpgrade softhsm-debugsourceUpgrade xmlstreambufferUpgrade ipa-server-trust-adUpgrade pki-tools-debuginfoUpgrade slapi-nisUpgrade glassfish-fastinfosetUpgrade python3-yubicoUpgrade pcs-snmpUpgrade ipa-clientUpgrade stax-exNo solution exists | Oct 1, 2020 | Apr 20, 2019 |
| Rocky_linux | — | Upgrade pcs-snmpUpgrade python3-nss-debuginfoUpgrade python-nss-debugsourceUpgrade python-nss-docUpgrade python3-nssUpgrade pcs | Mar 12, 2024 | Apr 20, 2019 |
| Suse | — | Upgrade python3-django | Aug 9, 2019 | Apr 19, 2019 |
| Ubuntu | — | Upgrade libjs-jquery (Ubuntu Pro) | Jun 26, 2025 | Apr 20, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub