jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Object.prototype.
CVSS Details
- CVSS 3.1 Base Score: 6.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade python3-pyusbUpgrade python3-kdcproxyUpgrade python3-qrcodeUpgrade custodiaUpgrade python3-jwcryptoUpgrade python3-qrcode-coreUpgrade python3-custodiaUpgrade python3-yubico | May 4, 2022 | Apr 20, 2019 |
| Alpine Linux | — | Upgrade drupal7Upgrade rabbitmq-server | Jun 21, 2019 | Apr 19, 2019 |
| Amazon Linux Ami 2 | — | Upgrade ipa-server-trust-adUpgrade python2-ipaclientUpgrade python2-ipaserverUpgrade ipa-python-compatUpgrade pcs-snmpUpgrade ipa-server-commonUpgrade ipa-debuginfoUpgrade python2-ipalibUpgrade pcsUpgrade ipa-clientUpgrade ipa-commonUpgrade ipa-client-commonUpgrade ipa-serverUpgrade ipa-server-dnsUpgrade pcs-debuginfo | Oct 28, 2020 | Apr 20, 2019 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Apr 19, 2019 |
| Centos_linux | — | Upgrade pki-symkeyUpgrade ipa-python-compatUpgrade glassfish-jaxb-txw2Upgrade javassist-javadocUpgrade ipa-server-debuginfoUpgrade jakarta-commons-httpclientUpgrade python3-qrcodeUpgrade python-nss-docUpgrade jss-debugsourceUpgrade pki-serverUpgrade python3-nss-debuginfoUpgrade pki-toolsUpgrade jackson-annotationsUpgrade jackson-module-jaxb-annotationsUpgrade resteasyUpgrade python-nss-debugsourceUpgrade python3-yubicoUpgrade bind-dyndb-ldapUpgrade bind-dyndb-ldap-debugsourceUpgrade tomcatjssUpgrade pki-kraUpgrade python3-ipaserverUpgrade ipa-client-epnUpgrade ldapjdk-javadocUpgrade softhsm-debuginfoUpgrade python3-jwcryptoUpgrade ipa-selinuxUpgrade ipa-healthcheckUpgrade pki-base-javaUpgrade python3-ipaclientUpgrade jss-javadocUpgrade jackson-jaxrs-json-providerUpgrade pki-caUpgrade pki-servlet-engineUpgrade pki-symkey-debuginfoUpgrade slapi-nis-debugsourceUpgrade slf4j-jdk14Upgrade xalan-j2Upgrade bind-dyndb-ldap-debuginfoUpgrade jackson-jaxrs-providersUpgrade ipa-clientUpgrade glassfish-fastinfosetUpgrade slf4jUpgrade softhsm-develUpgrade python3-pkiUpgrade xml-commons-apisUpgrade apache-commons-langUpgrade xsomUpgrade pcs-snmpUpgrade ipa-server-trust-ad-debuginfoUpgrade ipa-commonUpgrade ipa-serverUpgrade relaxngDatatypeUpgrade slapi-nis-debuginfoUpgrade ipa-client-sambaUpgrade stax-exUpgrade python2-ipaserverUpgrade jackson-coreUpgrade velocityUpgrade xmlstreambufferUpgrade python3-nssUpgrade xml-commons-resolverUpgrade ldapjdkUpgrade pki-core-debugsourceUpgrade pki-tools-debuginfoUpgrade glassfish-jaxb-apiUpgrade apache-commons-collectionsUpgrade ipa-client-debuginfoUpgrade ipa-server-commonUpgrade glassfish-jaxb-runtimeUpgrade ipa-debuginfoUpgrade python3-pyusbUpgrade opendnssec-debuginfoUpgrade python2-ipalibUpgrade pki-baseUpgrade jssUpgrade pki-servlet-4.0-apiUpgrade custodiaUpgrade pki-core-debuginfoUpgrade pcs-debuginfoUpgrade python3-ipalibUpgrade python2-ipaclientUpgrade bea-stax-apiUpgrade python3-kdcproxyUpgrade pcsUpgrade softhsm-debugsourceUpgrade opendnssec-debugsourceUpgrade softhsmUpgrade javassistUpgrade jss-debuginfoUpgrade apache-commons-netUpgrade ipa-client-commonUpgrade xerces-j2Upgrade python3-qrcode-coreUpgrade jackson-databindUpgrade glassfish-jaxb-coreUpgrade ipa-healthcheck-coreUpgrade ipa-server-dnsUpgrade opendnssecUpgrade python3-custodiaUpgrade slapi-nisUpgrade ipa-server-trust-adUpgrade ipa-debugsource | Oct 1, 2020 | Apr 20, 2019 |
| Debian | — | Upgrade mediawikiUpgrade node-jqueryUpgrade otrs2 | Apr 22, 2019 | Apr 19, 2019 |
| Drupal | — | Upgrade to drupal version 8.6.1Upgrade to drupal version 7.66Upgrade to drupal version 8.5.1 | Apr 23, 2019 | Apr 19, 2019 |
| Freebsd | — | Upgrade py37-django22Upgrade py35-django22Upgrade mediawiki132Upgrade py35-django21Upgrade py27-django111Upgrade py35-django111Upgrade mediawiki131Upgrade py36-django111Upgrade py37-django111Upgrade py37-django21Upgrade py36-django21Upgrade py36-django22 | Jul 5, 2019 | Jul 5, 2019 |
| Huawei Euleros 2_0_sp2 | — | Upgrade pki-kraUpgrade pki-toolsUpgrade pki-caUpgrade pki-baseUpgrade pki-symkeyUpgrade pki-server | Feb 22, 2021 | Apr 20, 2019 |
| Huawei Euleros 2_0_sp3 | — | Upgrade pki-toolsUpgrade pki-kraUpgrade pki-serverUpgrade pki-symkeyUpgrade pki-base-javaUpgrade pki-caUpgrade pki-base | Apr 30, 2021 | Apr 20, 2019 |
| Huawei Euleros 2_0_sp5 | — | Upgrade pki-baseUpgrade pki-toolsUpgrade pki-caUpgrade pki-serverUpgrade pki-base-javaUpgrade pki-kraUpgrade pki-symkey | Dec 16, 2020 | Apr 20, 2019 |
| Jquery | — | Upgrade jQuery to version 3.4.0 | Apr 24, 2019 | Apr 20, 2019 |
| Oracle Solaris | — | Upgrade library/python/django-34 to version 1.11.23-11.4.14.0.1.3.0 on Solaris 11.4Upgrade library/python-2/django-27 to version 1.4.10-11.4.0.0.1.9.0 on Solaris 11.4Upgrade library/python/django-37 to version 1.11.23-11.4.14.0.1.3.0 on Solaris 11.4Upgrade network/amqp/rabbitmq to version 3.8.3-11.4.24.0.1.75.1 on Solaris 11.4Upgrade library/python/django to version 1.11.23-11.4.14.0.1.3.0 on Solaris 11.4Upgrade legacy/library/python/django-27 to version 1.11.29-11.4.21.0.1.69.0 on Solaris 11.4Upgrade library/python/django-27 to version 1.11.23-11.4.14.0.1.3.0 on Solaris 11.4Upgrade consolidation/osnet/osnet-incorporation to version 11.4-11.4.24.0.1.75.3 on Solaris 11.4Upgrade legacy/library/python/django-35 to version 1.11.29-11.4.21.0.1.69.0 on Solaris 11.4Upgrade library/python/django-26 to version 1.4.22-11.4.0.0.1.9.0 on Solaris 11.4Upgrade legacy/library/python/django-34 to version 1.11.29-11.4.21.0.1.69.0 on Solaris 11.4Upgrade library/python-2/django-26 to version 1.4.22-11.4.0.0.0.13.0 on Solaris 11.4Upgrade library/python/django-35 to version 1.11.23-11.4.14.0.1.3.0 on Solaris 11.4Upgrade library/python-2/django to version 1.4.10-11.4.0.0.1.9.0 on Solaris 11.4 | Oct 16, 2019 | Apr 20, 2019 |
| Oracle Weblogic | — | Apply the Patch Set Update (PSU) 30386660 for version 12.2.1.3.0.Apply the Patch Set Update (PSU) 30108725 for version 12.1.3.0.0. | Oct 17, 2019 | Apr 20, 2019 |
| Oracle_linux | — | Upgrade pki-toolsUpgrade ipa-client-epnUpgrade glassfish-jaxb-runtimeUpgrade slf4j-jdk14Upgrade jssUpgrade jackson-jaxrs-json-providerUpgrade jackson-jaxrs-providersUpgrade stax-exUpgrade ipa-selinuxUpgrade pki-kraUpgrade jackson-databindUpgrade python3-kdcproxyUpgrade pcs-snmpUpgrade pki-symkeyUpgrade xerces-j2Upgrade xmlstreambufferUpgrade python3-qrcodeUpgrade xml-commons-resolverUpgrade pki-servlet-4.0-apiUpgrade pki-caUpgrade python-nss-docUpgrade ipa-healthcheck-coreUpgrade xml-commons-apisUpgrade custodiaUpgrade ipa-healthcheckUpgrade python3-nssUpgrade python3-ipaclientUpgrade jackson-coreUpgrade python2-ipaserverUpgrade xsomUpgrade pki-baseUpgrade softhsmUpgrade tomcatjssUpgrade ipa-client-sambaUpgrade glassfish-jaxb-coreUpgrade apache-commons-langUpgrade glassfish-fastinfosetUpgrade ipa-commonUpgrade slapi-nisUpgrade jss-javadocUpgrade python3-pyusbUpgrade python3-custodiaUpgrade pki-serverUpgrade ipa-server-dnsUpgrade bind-dyndb-ldapUpgrade javassistUpgrade apache-commons-collectionsUpgrade apache-commons-netUpgrade softhsm-develUpgrade pcsUpgrade xalan-j2Upgrade python2-ipaclientUpgrade relaxngDatatypeUpgrade python3-pkiUpgrade pki-servlet-engineUpgrade glassfish-jaxb-txw2Upgrade glassfish-jaxb-apiUpgrade pki-base-javaUpgrade jackson-module-jaxb-annotationsUpgrade opendnssecUpgrade ipa-python-compatUpgrade jakarta-commons-httpclientUpgrade resteasyUpgrade python3-yubicoUpgrade bea-stax-apiUpgrade slf4jUpgrade velocityUpgrade ipa-server-trust-adUpgrade ldapjdk-javadocUpgrade python3-qrcode-coreUpgrade ipa-clientUpgrade jackson-annotationsUpgrade python3-jwcryptoUpgrade ipa-server-commonUpgrade python2-ipalibUpgrade ipa-serverUpgrade ipa-client-commonUpgrade python3-ipalibUpgrade python3-ipaserverUpgrade javassist-javadocUpgrade ldapjdk | Oct 7, 2020 | Mar 27, 2019 |
| Pulse Secure Pulse Connect Secure | — | Update Pulse Connect Secure to version 9.1R9 | Oct 28, 2020 | Apr 20, 2019 |
| Red Hat Jboss Eap | — | Upgrade Red Hat JBoss EAP to the latest version | Sep 19, 2024 | Mar 27, 2019 |
| Red_hat Jboss_eap | — | — | Apr 10, 2023 | Apr 20, 2019 |
| Redhat Openshift | — | Upgrade atomic-openshift-dockerregistryUpgrade openshift-enterprise-autohealUpgrade golang-github-prometheus-node_exporterUpgrade atomic-openshift-service-idlerUpgrade golang-github-prometheus-alertmanagerUpgrade openshift-ansibleUpgrade jenkinsUpgrade atomic-openshiftUpgrade atomic-openshift-deschedulerUpgrade atomic-openshift-web-consoleUpgrade openshift-kuryrUpgrade golang-github-openshift-oauth-proxyUpgrade atomic-openshift-node-problem-detectorUpgrade atomic-openshift-metrics-serverUpgrade golang-github-prometheus-prometheusUpgrade atomic-enterprise-service-catalogUpgrade atomic-openshift-cluster-autoscalerUpgrade openshift-enterprise-cluster-capacityUpgrade cri-oUpgrade jenkins-2-plugins | Dec 29, 2020 | Mar 27, 2019 |
| Redhat_linux | — | Upgrade stax-exUpgrade ipa-debuginfoUpgrade jackson-jaxrs-providersUpgrade ipa-serverUpgrade ipa-client-commonUpgrade xmlstreambufferUpgrade python2-ipalibUpgrade pcs-snmpUpgrade softhsm-develUpgrade jss-javadocUpgrade opendnssecUpgrade glassfish-jaxb-coreUpgrade ipa-server-debuginfoUpgrade softhsmUpgrade bind-dyndb-ldap-debuginfoUpgrade python3-pyusbUpgrade bea-stax-apiNo solution existsUpgrade jakarta-commons-httpclientUpgrade python2-ipaclientUpgrade xerces-j2Upgrade opendnssec-debuginfoUpgrade python3-custodiaUpgrade jackson-module-jaxb-annotationsUpgrade ipa-clientUpgrade pki-symkey-debuginfoUpgrade ipa-client-debuginfoUpgrade tomcatjssUpgrade python3-jwcryptoUpgrade ipa-server-dnsUpgrade resteasyUpgrade slf4j-jdk14Upgrade javassistUpgrade pki-base-javaUpgrade slapi-nis-debuginfoUpgrade python3-ipaserverUpgrade pki-tools-debuginfoUpgrade xml-commons-apisUpgrade glassfish-fastinfosetUpgrade softhsm-debugsourceUpgrade ipa-server-trust-adUpgrade python3-yubicoUpgrade ipa-python-compatUpgrade slapi-nisUpgrade slapi-nis-debugsourceUpgrade python3-pkiUpgrade velocityUpgrade ldapjdkUpgrade ipa-commonUpgrade python3-qrcode-coreUpgrade glassfish-jaxb-apiUpgrade pki-servlet-engineUpgrade pki-baseUpgrade ipa-client-sambaUpgrade softhsm-debuginfoUpgrade ldapjdk-javadocUpgrade ipa-debugsourceUpgrade pki-kraUpgrade apache-commons-langUpgrade ipa-client-epnUpgrade xml-commons-resolverUpgrade python3-ipaclientUpgrade pki-servlet-4.0-apiUpgrade jackson-annotationsUpgrade pki-toolsUpgrade ipa-selinuxUpgrade pki-caUpgrade ipa-healthcheckUpgrade pcs-debuginfoUpgrade apache-commons-netUpgrade bind-dyndb-ldapUpgrade python3-ipalibUpgrade xsomUpgrade javassist-javadocUpgrade python3-kdcproxyUpgrade pki-symkeyUpgrade jssUpgrade pki-core-debuginfoUpgrade jackson-coreUpgrade ipa-server-trust-ad-debuginfoUpgrade ipa-server-commonUpgrade pcsUpgrade custodiaUpgrade xalan-j2Upgrade jss-debuginfoUpgrade bind-dyndb-ldap-debugsourceUpgrade pki-serverUpgrade python-nss-docUpgrade jackson-jaxrs-json-providerUpgrade python-nss-debugsourceUpgrade python2-ipaserverUpgrade pki-core-debugsourceUpgrade relaxngDatatypeUpgrade glassfish-jaxb-runtimeUpgrade jss-debugsourceUpgrade python3-nssUpgrade glassfish-jaxb-txw2Upgrade python3-nss-debuginfoUpgrade ipa-healthcheck-coreUpgrade python3-qrcodeUpgrade apache-commons-collectionsUpgrade jackson-databindUpgrade slf4jUpgrade opendnssec-debugsource | Oct 1, 2020 | Apr 20, 2019 |
| Rocky_linux | — | Upgrade python-nss-debugsourceUpgrade pcs-snmpUpgrade python3-nss-debuginfoUpgrade python3-nssUpgrade pcsUpgrade python-nss-doc | Mar 12, 2024 | Apr 20, 2019 |
| Suse | — | Upgrade python3-django | Aug 9, 2019 | Apr 19, 2019 |
| Ubuntu | — | Upgrade libjs-jquery (Ubuntu Pro) | Jun 26, 2025 | Apr 20, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub