jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Object.prototype.
CVSS Details
- CVSS 3.1 Base Score: 6.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade python3-jwcryptoUpgrade python3-qrcode-coreUpgrade custodiaUpgrade python3-yubicoUpgrade python3-custodiaUpgrade python3-pyusbUpgrade python3-kdcproxyUpgrade python3-qrcode | May 4, 2022 | Apr 20, 2019 |
| Alpine Linux | — | Upgrade rabbitmq-serverUpgrade drupal7 | Jun 21, 2019 | Apr 19, 2019 |
| Amazon Linux Ami 2 | — | Upgrade ipa-serverUpgrade ipa-commonUpgrade ipa-debuginfoUpgrade ipa-server-commonUpgrade python2-ipalibUpgrade ipa-python-compatUpgrade pcs-snmpUpgrade pcs-debuginfoUpgrade ipa-client-commonUpgrade ipa-server-dnsUpgrade pcsUpgrade ipa-clientUpgrade ipa-server-trust-adUpgrade python2-ipaclientUpgrade python2-ipaserver | Oct 28, 2020 | Apr 20, 2019 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Apr 19, 2019 |
| Centos_linux | — | Upgrade python3-nssUpgrade python3-custodiaUpgrade ipa-debugsourceUpgrade xmlstreambufferUpgrade ipa-server-trust-adUpgrade pki-tools-debuginfoUpgrade slapi-nisUpgrade pki-core-debugsourceUpgrade pki-serverUpgrade ipa-clientUpgrade jackson-annotationsUpgrade ldapjdk-javadocUpgrade ipa-serverUpgrade jss-debugsourceUpgrade python3-ipaserverUpgrade ipa-client-sambaUpgrade ipa-healthcheckUpgrade stax-exUpgrade pki-kraUpgrade pcs-snmpUpgrade slf4j-jdk14Upgrade xml-commons-apisUpgrade pki-servlet-engineUpgrade python-nss-debugsourceUpgrade python3-yubicoUpgrade tomcatjssUpgrade jss-javadocUpgrade ipa-commonUpgrade jackson-coreUpgrade slapi-nis-debuginfoUpgrade bind-dyndb-ldap-debuginfoUpgrade xalan-j2Upgrade softhsm-develUpgrade jackson-jaxrs-providersUpgrade bind-dyndb-ldapUpgrade pki-base-javaUpgrade python3-pkiUpgrade apache-commons-langUpgrade ipa-client-epnUpgrade pki-symkey-debuginfoUpgrade python2-ipaserverUpgrade pki-caUpgrade glassfish-fastinfosetUpgrade jackson-module-jaxb-annotationsUpgrade slf4jUpgrade python3-jwcryptoUpgrade xsomUpgrade ipa-server-trust-ad-debuginfoUpgrade pki-toolsUpgrade bind-dyndb-ldap-debugsourceUpgrade relaxngDatatypeUpgrade slapi-nis-debugsourceUpgrade softhsm-debuginfoUpgrade ipa-selinuxUpgrade python3-nss-debuginfoUpgrade python3-ipaclientUpgrade resteasyUpgrade velocityUpgrade jackson-jaxrs-json-providerUpgrade pki-servlet-4.0-apiUpgrade pki-core-debuginfoUpgrade python-nss-docUpgrade jssUpgrade pcs-debuginfoUpgrade python2-ipalibUpgrade ipa-client-debuginfoUpgrade ipa-server-debuginfoUpgrade javassist-javadocUpgrade glassfish-jaxb-apiUpgrade ldapjdkUpgrade javassistUpgrade python3-qrcode-coreUpgrade apache-commons-collectionsUpgrade apache-commons-netUpgrade ipa-client-commonUpgrade xerces-j2Upgrade opendnssec-debuginfoUpgrade softhsm-debugsourceUpgrade jss-debuginfoUpgrade bea-stax-apiUpgrade ipa-debuginfoUpgrade jakarta-commons-httpclientUpgrade pki-symkeyUpgrade python3-qrcodeUpgrade ipa-server-commonUpgrade python3-pyusbUpgrade ipa-server-dnsUpgrade jackson-databindUpgrade glassfish-jaxb-coreUpgrade opendnssecUpgrade ipa-healthcheck-coreUpgrade python3-kdcproxyUpgrade pki-baseUpgrade glassfish-jaxb-txw2Upgrade glassfish-jaxb-runtimeUpgrade ipa-python-compatUpgrade softhsmUpgrade opendnssec-debugsourceUpgrade python2-ipaclientUpgrade python3-ipalibUpgrade xml-commons-resolverUpgrade pcsUpgrade custodia | Oct 1, 2020 | Apr 20, 2019 |
| Debian | — | Upgrade otrs2Upgrade mediawikiUpgrade node-jquery | Apr 22, 2019 | Apr 19, 2019 |
| Drupal | — | Upgrade to drupal version 8.6.1Upgrade to drupal version 7.66Upgrade to drupal version 8.5.1 | Apr 23, 2019 | Apr 19, 2019 |
| Freebsd | — | Upgrade py35-django21Upgrade py37-django22Upgrade py35-django22Upgrade py27-django111Upgrade mediawiki132Upgrade py36-django21Upgrade py37-django111Upgrade mediawiki131Upgrade py36-django22Upgrade py36-django111Upgrade py35-django111Upgrade py37-django21 | Jul 5, 2019 | Jul 5, 2019 |
| Huawei Euleros 2_0_sp2 | — | Upgrade pki-toolsUpgrade pki-kraUpgrade pki-symkeyUpgrade pki-serverUpgrade pki-caUpgrade pki-base | Feb 22, 2021 | Apr 20, 2019 |
| Huawei Euleros 2_0_sp3 | — | Upgrade pki-baseUpgrade pki-kraUpgrade pki-base-javaUpgrade pki-serverUpgrade pki-caUpgrade pki-symkeyUpgrade pki-tools | Apr 30, 2021 | Apr 20, 2019 |
| Huawei Euleros 2_0_sp5 | — | Upgrade pki-baseUpgrade pki-serverUpgrade pki-toolsUpgrade pki-symkeyUpgrade pki-caUpgrade pki-base-javaUpgrade pki-kra | Dec 16, 2020 | Apr 20, 2019 |
| Jquery | — | Upgrade jQuery to version 3.4.0 | Apr 24, 2019 | Apr 20, 2019 |
| Oracle Solaris | — | Upgrade library/python/django-35 to version 1.11.23-11.4.14.0.1.3.0 on Solaris 11.4Upgrade library/python-2/django-26 to version 1.4.22-11.4.0.0.0.13.0 on Solaris 11.4Upgrade library/python/django to version 1.11.23-11.4.14.0.1.3.0 on Solaris 11.4Upgrade legacy/library/python/django-27 to version 1.11.29-11.4.21.0.1.69.0 on Solaris 11.4Upgrade library/python-2/django to version 1.4.10-11.4.0.0.1.9.0 on Solaris 11.4Upgrade library/python/django-26 to version 1.4.22-11.4.0.0.1.9.0 on Solaris 11.4Upgrade legacy/library/python/django-34 to version 1.11.29-11.4.21.0.1.69.0 on Solaris 11.4Upgrade legacy/library/python/django-35 to version 1.11.29-11.4.21.0.1.69.0 on Solaris 11.4Upgrade library/python/django-27 to version 1.11.23-11.4.14.0.1.3.0 on Solaris 11.4Upgrade consolidation/osnet/osnet-incorporation to version 11.4-11.4.24.0.1.75.3 on Solaris 11.4Upgrade network/amqp/rabbitmq to version 3.8.3-11.4.24.0.1.75.1 on Solaris 11.4Upgrade library/python/django-34 to version 1.11.23-11.4.14.0.1.3.0 on Solaris 11.4Upgrade library/python/django-37 to version 1.11.23-11.4.14.0.1.3.0 on Solaris 11.4Upgrade library/python-2/django-27 to version 1.4.10-11.4.0.0.1.9.0 on Solaris 11.4 | Oct 16, 2019 | Apr 20, 2019 |
| Oracle Weblogic | — | Apply the Patch Set Update (PSU) 30386660 for version 12.2.1.3.0.Apply the Patch Set Update (PSU) 30108725 for version 12.1.3.0.0. | Oct 17, 2019 | Apr 20, 2019 |
| Oracle_linux | — | Upgrade ipa-selinuxUpgrade python2-ipaserverUpgrade xml-commons-apisUpgrade ipa-healthcheck-coreUpgrade pki-caUpgrade slf4j-jdk14Upgrade pki-kraUpgrade pki-symkeyUpgrade xml-commons-resolverUpgrade python-nss-docUpgrade python3-qrcodeUpgrade xerces-j2Upgrade jackson-databindUpgrade pki-servlet-4.0-apiUpgrade python3-kdcproxyUpgrade glassfish-jaxb-runtimeUpgrade pki-toolsUpgrade ipa-client-epnUpgrade python3-nssUpgrade jackson-coreUpgrade xmlstreambufferUpgrade xsomUpgrade stax-exUpgrade pcs-snmpUpgrade jssUpgrade ipa-healthcheckUpgrade jackson-jaxrs-json-providerUpgrade pki-baseUpgrade jackson-jaxrs-providersUpgrade python3-ipaclientUpgrade custodiaUpgrade python3-pkiUpgrade ldapjdk-javadocUpgrade tomcatjssUpgrade ipa-server-trust-adUpgrade velocityUpgrade glassfish-jaxb-apiUpgrade pki-servlet-engineUpgrade slf4jUpgrade python3-qrcode-coreUpgrade pki-base-javaUpgrade ipa-clientUpgrade ipa-server-commonUpgrade python3-ipalibUpgrade xalan-j2Upgrade pki-serverUpgrade ipa-server-dnsUpgrade javassist-javadocUpgrade apache-commons-langUpgrade bea-stax-apiUpgrade ipa-commonUpgrade slapi-nisUpgrade ipa-python-compatUpgrade ipa-client-commonUpgrade jss-javadocUpgrade ipa-serverUpgrade python3-ipaserverUpgrade python3-custodiaUpgrade apache-commons-netUpgrade softhsm-develUpgrade relaxngDatatypeUpgrade javassistUpgrade apache-commons-collectionsUpgrade pcsUpgrade jackson-annotationsUpgrade ipa-client-sambaUpgrade ldapjdkUpgrade resteasyUpgrade opendnssecUpgrade python2-ipaclientUpgrade jackson-module-jaxb-annotationsUpgrade glassfish-jaxb-txw2Upgrade python3-yubicoUpgrade softhsmUpgrade python3-jwcryptoUpgrade python2-ipalibUpgrade glassfish-jaxb-coreUpgrade python3-pyusbUpgrade jakarta-commons-httpclientUpgrade glassfish-fastinfosetUpgrade bind-dyndb-ldap | Oct 7, 2020 | Mar 27, 2019 |
| Pulse Secure Pulse Connect Secure | — | Update Pulse Connect Secure to version 9.1R9 | Oct 28, 2020 | Apr 20, 2019 |
| Red Hat Jboss Eap | — | Upgrade Red Hat JBoss EAP to the latest version | Sep 19, 2024 | Mar 27, 2019 |
| Red_hat Jboss_eap | — | — | Apr 10, 2023 | Apr 20, 2019 |
| Redhat Openshift | — | Upgrade openshift-enterprise-cluster-capacityUpgrade jenkins-2-pluginsUpgrade openshift-kuryrUpgrade golang-github-openshift-oauth-proxyUpgrade atomic-openshift-metrics-serverUpgrade atomic-enterprise-service-catalogUpgrade golang-github-prometheus-prometheusUpgrade atomic-openshift-cluster-autoscalerUpgrade atomic-openshift-node-problem-detectorUpgrade atomic-openshiftUpgrade cri-oUpgrade atomic-openshift-deschedulerUpgrade atomic-openshift-web-consoleUpgrade openshift-enterprise-autohealUpgrade golang-github-prometheus-node_exporterUpgrade atomic-openshift-dockerregistryUpgrade golang-github-prometheus-alertmanagerUpgrade jenkinsUpgrade atomic-openshift-service-idlerUpgrade openshift-ansible | Dec 29, 2020 | Mar 27, 2019 |
| Redhat_linux | — | Upgrade opendnssec-debugsourceUpgrade python3-kdcproxyUpgrade pki-toolsUpgrade jss-debugsourceUpgrade xsomUpgrade apache-commons-collectionsUpgrade bind-dyndb-ldapUpgrade xml-commons-resolverUpgrade ipa-healthcheck-coreUpgrade pki-symkeyUpgrade pki-core-debuginfoUpgrade jackson-jaxrs-json-providerUpgrade python3-ipalibUpgrade glassfish-jaxb-runtimeUpgrade jackson-annotationsUpgrade jackson-coreUpgrade ipa-server-trust-ad-debuginfoUpgrade pki-baseUpgrade ipa-client-sambaUpgrade glassfish-jaxb-txw2Upgrade javassist-javadocUpgrade python3-nss-debuginfoUpgrade custodiaUpgrade xalan-j2Upgrade python3-qrcodeUpgrade bind-dyndb-ldap-debugsourceUpgrade python2-ipaserverUpgrade relaxngDatatypeUpgrade ipa-selinuxUpgrade python-nss-debugsourceUpgrade pki-core-debugsourceUpgrade ipa-healthcheckUpgrade jackson-databindUpgrade ipa-server-commonUpgrade jssUpgrade pcs-debuginfoUpgrade python-nss-docUpgrade python3-ipaclientUpgrade pki-caUpgrade slf4jUpgrade jss-debuginfoUpgrade apache-commons-netUpgrade pki-serverUpgrade python3-nssUpgrade pki-servlet-4.0-apiUpgrade softhsm-debuginfoUpgrade pcsUpgrade pki-kraUpgrade ipa-debugsourceUpgrade ldapjdk-javadocUpgrade bind-dyndb-ldap-debuginfoUpgrade ipa-serverUpgrade xerces-j2Upgrade opendnssecUpgrade pki-base-javaUpgrade softhsm-develUpgrade xml-commons-apisUpgrade softhsmUpgrade pcs-snmpUpgrade ipa-server-trust-adUpgrade jakarta-commons-httpclientUpgrade python3-jwcryptoUpgrade ipa-server-debuginfoUpgrade python3-yubicoUpgrade pki-servlet-engineUpgrade velocityUpgrade python3-qrcode-coreUpgrade python3-pkiUpgrade apache-commons-langUpgrade slapi-nis-debuginfoUpgrade jackson-jaxrs-providersUpgrade python3-custodiaUpgrade ipa-client-commonUpgrade ipa-client-epnUpgrade python3-ipaserverUpgrade ipa-client-debuginfoUpgrade slapi-nisUpgrade ipa-clientUpgrade opendnssec-debuginfoUpgrade ldapjdkUpgrade glassfish-jaxb-apiUpgrade slapi-nis-debugsourceUpgrade stax-exUpgrade python2-ipaclientNo solution existsUpgrade pki-symkey-debuginfoUpgrade jss-javadocUpgrade bea-stax-apiUpgrade python2-ipalibUpgrade jackson-module-jaxb-annotationsUpgrade glassfish-jaxb-coreUpgrade ipa-debuginfoUpgrade xmlstreambufferUpgrade resteasyUpgrade ipa-server-dnsUpgrade glassfish-fastinfosetUpgrade slf4j-jdk14Upgrade softhsm-debugsourceUpgrade pki-tools-debuginfoUpgrade python3-pyusbUpgrade tomcatjssUpgrade javassistUpgrade ipa-python-compatUpgrade ipa-common | Oct 1, 2020 | Apr 20, 2019 |
| Rocky_linux | — | Upgrade pcs-snmpUpgrade python3-nss-debuginfoUpgrade python-nss-debugsourceUpgrade python-nss-docUpgrade pcsUpgrade python3-nss | Mar 12, 2024 | Apr 20, 2019 |
| Suse | — | Upgrade python3-django | Aug 9, 2019 | Apr 19, 2019 |
| Ubuntu | — | Upgrade libjs-jquery (Ubuntu Pro) | Jun 26, 2025 | Apr 20, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub