Prototype pollution in jQuery - CVE-2019-11358

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU18092

Prototype pollution in jQuery - CVE-2019-11358

Published: March 28, 2019 / Updated: March 6, 2024


Vulnerability identifier: #VU18092
CSH Severity: Low
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2019-11358
CWE-ID: CWE-1321
Exploitation vector: Remote access
Exploit availability: Public exploit is available

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary JavaScript code.

The vulnerability exists due to improper input validation. A remote attacker can pass specially crafted input to the application and perform prototype pollution, which can result in information disclosure or data manipulation.


Affected software

jQuery
watsonx.data
Arch Linux
Oracle Linux
Fedora
Red Hat Enterprise Linux Resilient Storage for x86_64
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, big endian
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for Power, little endian
Anolis OS
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for x86_64
Ubuntu
SUSE Linux
Opensuse
Planning Analytics Local
Oracle Real-Time Scheduler
Oracle Utilities Mobile Workforce Management
PeopleSoft Enterprise PeopleTools
PT-G503
Dell EMC VxRail Appliance
IBM Cloud Pak for Watson AIOps
IBM Security Verify Information Queue
Oracle Transportation Management
Oracle Big Data Discovery
IBM Watson Machine Learning Accelerator
Oracle Banking Platform
App-Netdisco
Oracle Communications Operations Monitor
Tivoli Network Manager IP Edition
Oracle BI Publisher
Oracle Agile Product Lifecycle Management for Process
Oracle Financial Services Analytical Applications Infrastructure
Oracle Policy Automation Connector for Siebel
Oracle Application Testing Suite
Oracle Retail Customer Insights
Storage Copy Data Management
DB2 Warehouse on Cloud Pak for Data
DB2 on Cloud Pak for Data
IBM Engineering Lifecycle Optimization - Publishing
MobileFirst Platform
Robotic Process Automation for Cloud Pak
QRadar Pulse App
Cacti
Moodle
Oracle Hospitality Guest Access
Cloudera Data Platform Private Cloud Base for IBM
Oracle Knowledge
Oracle Business Process Management Suite
Oracle WebCenter Sites
Oracle Fusion Middleware MapViewer
SLUB: Event Registration
Log Analysis
IBM Process Mining
IBM Cloud Transformation Advisor
StorageTek Tape Analytics SW Tool
Oracle Communications WebRTC Session Controller
Oracle Communications Unified Inventory Management
Oracle Communications Diameter Signaling Router (DSR)
Oracle Financial Services Liquidity Risk Management
Oracle Financial Services Loan Loss Forecasting and Provisioning
Oracle Financial Services Profitability Management
Oracle Financial Services Price Creation and Discovery
Oracle Financial Services Asset Liability Management
Oracle Financial Services Data Foundation
Oracle Financial Services Institutional Performance Analytics
Oracle Insurance Data Foundation
Oracle Financial Services Analytical Applications Reconciliation Framework
Oracle Financial Services Regulatory Reporting for US Federal Reserve
Oracle Financial Services Data Integration Hub
Oracle Insurance Accounting Analyzer
Oracle Financial Services Enterprise Financial Performance Analytics
Oracle Financial Services Retail Performance Analytics
Oracle Financial Services Regulatory Reporting for European Banking Authority
Oracle Financial Services Liquidity Risk Measurement and Management
Oracle Insurance Allocation Manager for Enterprise Profitability
WebSphere eXtreme Scale
Tenable Nessus
Red Hat OpenStack
Red Hat OpenStack for IBM Power
Application Service Level Management
Oracle Food and Beverage Applications
Autodesk Infraworks
Netcool Operations Insight
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
IBM Decision Optimization for Cloud Pak for Data
Data Replication on Cloud Pak for Data
IBM Sterling B2B Integrator
Engineering Workflow Management
IBM Security Verify Governance - Containerized Identity Manager
IBM Security Verify Governance
Contrail Cloud
IBM Cloud Pak for Business Automation
Backdrop CMS
Django
Joomla!
Drupal
IBM Cloud Pak System
Oracle Financial Services Revenue Management and Billing
Oracle Healthcare Translational Research
Oracle Healthcare Foundation
Oracle Financial Services Funds Transfer Pricing
Oracle Financial Services Retail Customer Analytics
rabbitmq-server (Alpine package)
ipa (Red Hat package)
otrs (Alpine package)
drupal7 (Debian package)
drupal7 (Alpine package)
eap7-jboss-jsp (Red Hat package)
eap7-jboss-jsf (Red Hat package)
pcs
pcs-snmp
pcs (Red Hat package)
eap7-javaee-security-soteria (Red Hat package)
eap7-jettison (Red Hat package)
eap7-ironjacamar (Red Hat package)
jquery (Ubuntu package)
eap7-elytron-web (Red Hat package)
eap7-jboss-server-migration (Red Hat package)
eap7-wildfly-elytron (Red Hat package)
python-XStatic-jQuery (Red Hat package)
eap7-undertow (Red Hat package)
eap7-apache-sshd (Red Hat package)
eap7-jackson-modules-java8 (Red Hat package)
eap7-jackson-jaxrs-providers (Red Hat package)
eap7-jackson-databind (Red Hat package)
eap7-jackson-core (Red Hat package)
eap7-jackson-annotations (Red Hat package)
eap7-jackson-modules-base (Red Hat package)
eap7-hal-console (Red Hat package)
eap7-jboss-ejb-client (Red Hat package)
eap7-jboss-remoting (Red Hat package)
eap7-hibernate-search (Red Hat package)
eap7-woodstox-core (Red Hat package)
eap7-wildfly (Red Hat package)
drupal7
drupal8
rh-sso7-keycloak (Red Hat package)
Red Hat Virtualization Manager
CloudForms
Oracle Insurance Insbridge Rating and Underwriting
IBM Qradar SIEM
Oracle Financial Services Hedge Management and IFRS Valuations
Oracle Financial Services Market Risk Measurement and Management
Jazz Reporting Service
IBM Cognos Command Center
Oracle Communications Interactive Session Recorder
Oracle Communications Billing and Revenue Management
JBoss Enterprise Application Platform
Oracle WebLogic Server
Primavera Gateway
Juniper Secure Analytics (JSA)
Red Hat Single Sign-On
Oracle Financial Services Basel Regulatory Capital Internal Ratings Based Approach
Oracle Financial Services Basel Regulatory Capital Basic
Oracle Financial Services - Regulatory Reporting for US Federal Reserve - Lombard Risk Integration Pack
Oracle Insurance IFRS 17 Analyzer
Oracle Financial Services Regulatory Reporting for European Banking Authority - Integration Pack for Lombard Risk
Oracle Financial Services - Regulatory Reporting for Reserve Bank of India - Lombard Risk Integration Pack
Oracle Insurance Performance Insight
Oracle Retail Point of Service
Tape Library ACSLS
JD Edwards EnterpriseOne Tools
Primavera Unifier
System Utilities
IBM Tivoli Network Manager (ITNM)
Oracle JDeveloper
Oracle Service Bus
IBM InfoSphere Information Server
Oracle Policy Automation for Mobile Devices
Identity Manager
Oracle Enterprise Manager Ops Center
Serv-U FTP Server
IBM Storage Scale System
Siebel UI Framework

How to mitigate CVE-2019-11358

Update to version 3.4.0.

jQuery - update to 3.4.0
PT-G503 - update to 5.3
QRadar Pulse App - update to 2.2.9
IBM Security Verify Information Queue - update to 1.0.6
SLUB: Event Registration - update to 3.0.3
Cacti - update to 1.2.11
Log Analysis - update to 1.3.8.2 IF001
Backdrop CMS - addressed in versions 1.11.9, 1.12.6
IBM Process Mining - update to 1.12.0.4
IBM Cloud Transformation Advisor - update to 3.1.0
Django - addressed in versions 2.1.9, 2.2.2
IBM Cloud Pak System - update to 2.3.6.0
IBM Watson Machine Learning Accelerator - update to 2.6.0
App-Netdisco - update to 2.044003
Joomla! - update to 3.9.5
rabbitmq-server (Alpine package) - update to 3.7.17-r0
Moodle - addressed in versions 3.8.4, 3.9.0
ipa (Red Hat package) - update to 4.6.8-5.el7
Tivoli Network Manager IP Edition - update to 4.2.0.20
CloudForms - update to 5.10
otrs (Alpine package) - update to 6.0.33-r0
drupal7 (Debian package) - update to 7.52-2+deb9u8
Drupal - addressed in versions 7.66, 8.5.15, 8.6.15
Cloudera Data Platform Private Cloud Base for IBM - addressed in versions 7.1.7 SP3, 7.1.9 SP1
IBM Qradar SIEM - addressed in versions 7.3.3 Fix Pack 9, 7.4.3 Fix Pack 1
Oracle Financial Services Analytical Applications Infrastructure - update to 8.0.8.0
JBoss Enterprise Application Platform - update to 7.4.9
Juniper Secure Analytics (JSA) - update to 7.5.0 UP9 IF02
Red Hat Single Sign-On - update to 7.6.2
drupal7 (Alpine package) - update to 7.66-r0
Oracle Financial Services Loan Loss Forecasting and Provisioning - update to 8.0.7.8.1
Oracle Financial Services Profitability Management - update to 8.0.7.8.1
Oracle Financial Services Funds Transfer Pricing - update to 8.0.7.8.1
Oracle Financial Services Asset Liability Management - update to 8.0.7.8.0
Oracle Financial Services Data Foundation - update to 8.0.9
Oracle Financial Services Institutional Performance Analytics - update to 8.0.7.8.1
Oracle Insurance Data Foundation - update to 8.0.7.0.0
Oracle Financial Services Basel Regulatory Capital Internal Ratings Based Approach - update to 8.0.7.3
Oracle Financial Services Hedge Management and IFRS Valuations - update to 8.0.8
Oracle Financial Services Basel Regulatory Capital Basic - update to 8.0.7.3
Oracle Financial Services Analytical Applications Reconciliation Framework - update to 8.0.7.1.2
Oracle Financial Services Regulatory Reporting for US Federal Reserve - update to 8.0.7.0.0
Oracle Financial Services Retail Customer Analytics - update to 8.0.6.0.0
Oracle Financial Services Data Integration Hub - update to 8.0.7.3.1
Oracle Insurance Accounting Analyzer - update to 8.0.9
WebSphere eXtreme Scale - update to 8.6.1.5 PH53340
Tenable Nessus - update to 10.5.0
IBM InfoSphere Information Server - addressed in versions 11.7.1.0, 11.7.1.3, 11.7.1.3 Service pack 4
Serv-U FTP Server - update to 15.2.1
Autodesk Infraworks - addressed in versions 2019.3 Hotfix 5, 2020.2 Hotfix 4, 2021.2 Hotfix 4, 2022.0 Hotfix 3, 2022.1 Hotfix 2
eap7-jboss-jsp (Red Hat package) - addressed in versions api_2.3_spec-2.0.0-3.Final_redhat_00001.1.el7eap, api_2.3_spec-2.0.0-3.Final_redhat_00001.1.el8eap, api_2.3_spec-2.0.0-3.Final_redhat_00001.1.el9eap
eap7-jboss-jsf (Red Hat package) - addressed in versions api_2.3_spec-3.0.0-6.SP07_redhat_00001.1.el7eap, api_2.3_spec-3.0.0-6.SP07_redhat_00001.1.el8eap, api_2.3_spec-3.0.0-6.SP07_redhat_00001.1.el9eap
pcs - update to 0.9.169-3
pcs-snmp - update to 0.9.169-3
pcs (Red Hat package) - update to 0.9.169-3.el7_9.3
eap7-javaee-security-soteria (Red Hat package) - addressed in versions 1.0.1-3.redhat_00003.1.el7eap, 1.0.1-3.redhat_00003.1.el8eap, 1.0.1-3.redhat_00003.1.el9eap
eap7-jettison (Red Hat package) - addressed in versions 1.5.2-1.redhat_00002.1.el7eap, 1.5.2-1.redhat_00002.1.el8eap, 1.5.2-1.redhat_00002.1.el9eap
eap7-ironjacamar (Red Hat package) - addressed in versions 1.5.10-1.Final_redhat_00001.1.el7eap, 1.5.10-1.Final_redhat_00001.1.el8eap, 1.5.10-1.Final_redhat_00001.1.el9eap
Netcool Operations Insight - update to 1.6.8
jquery (Ubuntu package) - addressed in versions 1.7.2+dfsg-2ubuntu1+esm1, 1.11.3+dfsg-4ubuntu0.1~esm1, 3.2.1-1ubuntu0.1~esm1
eap7-elytron-web (Red Hat package) - addressed in versions 1.9.3-1.Final_redhat_00001.1.el7eap, 1.9.3-1.Final_redhat_00001.1.el8eap, 1.9.3-1.Final_redhat_00001.1.el9eap
eap7-jboss-server-migration (Red Hat package) - addressed in versions 1.10.0-24.Final_redhat_00023.1.el7eap, 1.10.0-24.Final_redhat_00023.1.el8eap, 1.10.0-24.Final_redhat_00023.1.el9eap
eap7-wildfly-elytron (Red Hat package) - addressed in versions 1.15.16-1.Final_redhat_00001.1.el7eap, 1.15.16-1.Final_redhat_00001.1.el8eap, 1.15.16-1.Final_redhat_00001.1.el9eap
watsonx.data - update to 2.1
python-XStatic-jQuery (Red Hat package) - addressed in versions 2.2.4.1-3.el7ost, 3.4.1.0-1.el8ost
eap7-undertow (Red Hat package) - addressed in versions 2.2.22-1.SP3_redhat_00001.1.el7eap, 2.2.22-1.SP3_redhat_00001.1.el8eap, 2.2.22-1.SP3_redhat_00001.1.el9eap
Storage Copy Data Management - update to 2.2.26.0
eap7-apache-sshd (Red Hat package) - addressed in versions 2.9.2-1.redhat_00001.1.el7eap, 2.9.2-1.redhat_00001.1.el8eap, 2.9.2-1.redhat_00001.1.el9eap
eap7-jackson-modules-java8 (Red Hat package) - addressed in versions 2.12.7-1.redhat_00003.1.el7eap, 2.12.7-1.redhat_00003.1.el8eap, 2.12.7-1.redhat_00003.1.el9eap
eap7-jackson-jaxrs-providers (Red Hat package) - addressed in versions 2.12.7-1.redhat_00003.1.el7eap, 2.12.7-1.redhat_00003.1.el8eap, 2.12.7-1.redhat_00003.1.el9eap
eap7-jackson-databind (Red Hat package) - addressed in versions 2.12.7-1.redhat_00003.1.el7eap, 2.12.7-1.redhat_00003.1.el8eap, 2.12.7-1.redhat_00003.1.el9eap
eap7-jackson-core (Red Hat package) - addressed in versions 2.12.7-1.redhat_00003.1.el7eap, 2.12.7-1.redhat_00003.1.el8eap, 2.12.7-1.redhat_00003.1.el9eap
eap7-jackson-annotations (Red Hat package) - addressed in versions 2.12.7-1.redhat_00003.1.el7eap, 2.12.7-1.redhat_00003.1.el8eap, 2.12.7-1.redhat_00003.1.el9eap
eap7-jackson-modules-base (Red Hat package) - addressed in versions 2.12.7-1.redhat_00003.1.el7eap, 2.12.7-1.redhat_00003.1.el8eap, 2.12.7-1.redhat_00003.1.el9eap
eap7-hal-console (Red Hat package) - addressed in versions 3.3.16-1.Final_redhat_00001.1.el7eap, 3.3.16-1.Final_redhat_00001.1.el8eap, 3.3.16-1.Final_redhat_00001.1.el9eap
eap7-jboss-ejb-client (Red Hat package) - addressed in versions 4.0.49-1.Final_redhat_00001.1.el7eap, 4.0.49-1.Final_redhat_00001.1.el8eap, 4.0.49-1.Final_redhat_00001.1.el9eap
IBM Tivoli Network Manager (ITNM) - update to 4.2.0.16
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data - update to 4.5.1
DB2 Warehouse on Cloud Pak for Data - update to 4.8.5
DB2 on Cloud Pak for Data - update to 4.8.5
IBM Decision Optimization for Cloud Pak for Data - update to 5.0
eap7-jboss-remoting (Red Hat package) - addressed in versions 5.0.27-1.Final_redhat_00001.1.el7eap, 5.0.27-1.Final_redhat_00001.1.el8eap, 5.0.27-1.Final_redhat_00001.1.el9eap
Data Replication on Cloud Pak for Data - update to 5.1.0
IBM Storage Scale System - addressed in versions 5.1.9.7, 5.2.2.0
eap7-hibernate-search (Red Hat package) - addressed in versions 5.10.13-3.Final_redhat_00001.1.el7eap, 5.10.13-3.Final_redhat_00001.1.el8eap, 5.10.13-3.Final_redhat_00001.1.el9eap
IBM Sterling B2B Integrator - addressed in versions 6.0.3.8, 6.1.2.2
eap7-woodstox-core (Red Hat package) - addressed in versions 6.4.0-1.redhat_00001.1.el7eap, 6.4.0-1.redhat_00001.1.el8eap, 6.4.0-1.redhat_00001.1.el9eap
Engineering Workflow Management - addressed in versions 7.0.1 iFix021, 7.0.2 iFix021
Jazz Reporting Service - update to 7.0.2 iFix025
IBM Engineering Lifecycle Optimization - Publishing - addressed in versions 7.0.2.27, 7.0.3.2
Dell EMC VxRail Appliance - update to 7.0.100
eap7-wildfly (Red Hat package) - addressed in versions 7.4.9-4.GA_redhat_00003.1.el7eap, 7.4.9-4.GA_redhat_00003.1.el8eap, 7.4.9-4.GA_redhat_00003.1.el9eap
drupal7 - addressed in versions 7.66-1.el6, 7.66-1.el7, 7.66-1.fc28, 7.66-1.fc29, 7.66-1.fc30
MobileFirst Platform - update to 8.0.0.0-MFPF-IF202304111626
drupal8 - addressed in versions 8.6.15-1.fc28, 8.6.15-1.fc29, 8.6.15-1.fc30
IBM Security Verify Governance - Containerized Identity Manager - update to 10.0.2
IBM Security Verify Governance - update to 10.0.2.0.1
IBM Cognos Command Center - update to 10.2.4 Fix Pack 1 IF17
Contrail Cloud - update to 16.3.0
rh-sso7-keycloak (Red Hat package) - addressed in versions 18.0.6-1.redhat_00001.1.el7sso, 18.0.6-1.redhat_00001.1.el8sso, 18.0.6-1.redhat_00001.1.el9sso
IBM Cloud Pak for Business Automation - addressed in versions 21.0.3.24, 23.0.1.2
Robotic Process Automation for Cloud Pak - addressed in versions 21.0.7.10, 23.0.10

Links to Public Exploits and PoC-codes

External References

Related Security Bulletins