jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Object.prototype.
AI analysis not yet available
Plain-English explanation, risk summary, and remediation steps will appear here once AI analysis is complete.
No Fix Known
No patch has been released yet. Apply workarounds or mitigations where available.
| Vendor | Product | Versions | Fixed In |
|---|---|---|---|
| jquery | jquery | 3.4.0 | - |
| debian | debian_linux | - | - |
| debian | debian_linux | - |
Published
CVE disclosed publicly
Last Modified
Most recent update
Indexed to CVEInsight
Added to this platform
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
218
Affected Products
146
References
jquery / jquery
| - |
| debian | debian_linux | - | - |
| drupal | drupal | 7.0 - 7.66 | - |
| drupal | drupal | 8.5.0 - 8.5.15 | - |
| drupal | drupal | 8.6.0 - 8.6.15 | - |
| backdropcms | backdrop | 1.11.0 - 1.11.9 | - |
| backdropcms | backdrop | 1.12.0 - 1.12.6 | - |
| fedoraproject | fedora | - | - |
| fedoraproject | fedora | - | - |
| fedoraproject | fedora | - | - |
| opensuse | backports_sle | - | - |
| opensuse | leap | - | - |
| netapp | oncommand_system_manager | 3.0 - 3.1.3 | - |
| netapp | snapcenter | - | - |
| redhat | cloudforms | - | - |
| redhat | virtualization_manager | - | - |
| oracle | agile_product_lifecycle_management_for_process | - | - |
| oracle | agile_product_lifecycle_management_for_process | - | - |
| oracle | agile_product_lifecycle_management_for_process | - | - |
| oracle | agile_product_lifecycle_management_for_process | - | - |
| oracle | agile_product_lifecycle_management_for_process | - | - |
| oracle | application_express | 19.1 | - |
| oracle | application_service_level_management | - | - |
| oracle | application_service_level_management | - | - |
| oracle | application_testing_suite | - | - |
| oracle | application_testing_suite | - | - |
| oracle | application_testing_suite | - | - |
| oracle | application_testing_suite | - | - |
| oracle | application_testing_suite | - | - |
| oracle | application_testing_suite | - | - |
| oracle | banking_digital_experience | - | - |
| oracle | banking_digital_experience | - | - |
| oracle | banking_digital_experience | - | - |
| oracle | banking_digital_experience | - | - |
| oracle | banking_digital_experience | - | - |
| oracle | banking_digital_experience | - | - |
| oracle | banking_enterprise_collections | 2.7.0 - 2.8.0 | - |
| oracle | banking_platform | 2.4.0 - 2.10.0 | - |
| oracle | bi_publisher | - | - |
| oracle | bi_publisher | - | - |
| oracle | bi_publisher | - | - |
| oracle | big_data_discovery | - | - |
| oracle | business_process_management_suite | - | - |
| oracle | business_process_management_suite | - | - |
| oracle | communications_analytics | - | - |
| oracle | communications_application_session_controller | - | - |
| oracle | communications_billing_and_revenue_management | - | - |
| oracle | communications_billing_and_revenue_management | - | - |
| oracle | communications_billing_and_revenue_management | - | - |
| oracle | communications_billing_and_revenue_management | - | - |
| oracle | communications_diameter_signaling_router | - | - |
| oracle | communications_diameter_signaling_router | - | - |
| oracle | communications_diameter_signaling_router | - | - |
| oracle | communications_diameter_signaling_router | - | - |
| oracle | communications_eagle_application_processor | 16.1.0 - 16.4.0 | - |
| oracle | communications_element_manager | - | - |
| oracle | communications_element_manager | - | - |
| oracle | communications_element_manager | - | - |
| oracle | communications_interactive_session_recorder | 6.0 - 6.4 | - |
| oracle | communications_operations_monitor | 4.1 - 4.3 | - |
| oracle | communications_operations_monitor | - | - |
| oracle | communications_operations_monitor | - | - |
| oracle | communications_operations_monitor | - | - |
| oracle | communications_services_gatekeeper | - | - |
| oracle | communications_session_report_manager | - | - |
| oracle | communications_session_report_manager | - | - |
| oracle | communications_session_report_manager | - | - |
| oracle | communications_session_route_manager | - | - |
| oracle | communications_session_route_manager | - | - |
| oracle | communications_session_route_manager | - | - |
| oracle | communications_unified_inventory_management | - | - |
| oracle | communications_unified_inventory_management | - | - |
| oracle | communications_webrtc_session_controller | - | - |
| oracle | diagnostic_assistant | - | - |
| oracle | enterprise_manager_ops_center | - | - |
| oracle | enterprise_manager_ops_center | - | - |
| oracle | enterprise_manager_ops_center | - | - |
| oracle | enterprise_session_border_controller | - | - |
| oracle | financial_services_analytical_applications_infrastructure | 7.3.3 - 7.3.5 | - |
| oracle | financial_services_analytical_applications_infrastructure | 8.0.2 - 8.1.0 | - |
| oracle | financial_services_analytical_applications_reconciliation_framework | 8.0.4 - 8.0.7 | - |
| oracle | financial_services_analytical_applications_reconciliation_framework | - | - |
| oracle | financial_services_asset_liability_management | 8.0.4 - 8.0.7 | - |
| oracle | financial_services_asset_liability_management | - | - |
| oracle | financial_services_balance_sheet_planning | - | - |
| oracle | financial_services_basel_regulatory_capital_basic | 8.0.4 - 8.0.7 | - |
| oracle | financial_services_basel_regulatory_capital_basic | - | - |
| oracle | financial_services_basel_regulatory_capital_internal_ratings_based_approach | 8.0.4 - 8.0.7 | - |
| oracle | financial_services_basel_regulatory_capital_internal_ratings_based_approach | - | - |
| oracle | financial_services_data_foundation | 8.0.4 - 8.0.8 | - |
| oracle | financial_services_data_governance_for_us_regulatory_reporting | 8.0.6 - 8.0.9 | - |
| oracle | financial_services_data_integration_hub | 8.0.5 - 8.0.7 | - |
| oracle | financial_services_data_integration_hub | - | - |
| oracle | financial_services_enterprise_financial_performance_analytics | - | - |
| oracle | financial_services_enterprise_financial_performance_analytics | - | - |
| oracle | financial_services_funds_transfer_pricing | 8.0.4 - 8.0.7 | - |
| oracle | financial_services_funds_transfer_pricing | - | - |
| oracle | financial_services_hedge_management_and_ifrs_valuations | 8.0.4 - 8.0.7 | - |
| oracle | financial_services_hedge_management_and_ifrs_valuations | - | - |
| oracle | financial_services_institutional_performance_analytics | 8.0.4 - 8.0.7 | - |
| oracle | financial_services_institutional_performance_analytics | - | - |
| oracle | financial_services_liquidity_risk_management | - | - |
| oracle | financial_services_liquidity_risk_management | - | - |
| oracle | financial_services_liquidity_risk_management | - | - |
| oracle | financial_services_liquidity_risk_management | - | - |
| oracle | financial_services_liquidity_risk_management | - | - |
| oracle | financial_services_liquidity_risk_measurement_and_management | - | - |
| oracle | financial_services_liquidity_risk_measurement_and_management | - | - |
| oracle | financial_services_liquidity_risk_measurement_and_management | - | - |
| oracle | financial_services_loan_loss_forecasting_and_provisioning | 8.0.2 - 8.0.7 | - |
| oracle | financial_services_loan_loss_forecasting_and_provisioning | - | - |
| oracle | financial_services_market_risk_measurement_and_management | - | - |
| oracle | financial_services_market_risk_measurement_and_management | - | - |
| oracle | financial_services_market_risk_measurement_and_management | - | - |
| oracle | financial_services_price_creation_and_discovery | 8.0.4 - 8.0.7 | - |
| oracle | financial_services_profitability_management | 8.0.4 - 8.0.7 | - |
| oracle | financial_services_profitability_management | - | - |
| oracle | financial_services_regulatory_reporting_for_de_nederlandsche_bank | - | - |
| oracle | financial_services_regulatory_reporting_for_european_banking_authority | - | - |
| oracle | financial_services_regulatory_reporting_for_european_banking_authority | - | - |
| oracle | financial_services_regulatory_reporting_for_us_federal_reserve | 8.0.4 - 8.0.7 | - |
| oracle | financial_services_retail_customer_analytics | 8.0.4 - 8.0.6 | - |
| oracle | financial_services_retail_performance_analytics | - | - |
| oracle | financial_services_retail_performance_analytics | - | - |
| oracle | financial_services_revenue_management_and_billing | - | - |
| oracle | financial_services_revenue_management_and_billing | - | - |
| oracle | fusion_middleware_mapviewer | - | - |
| oracle | healthcare_foundation | - | - |
| oracle | healthcare_foundation | - | - |
| oracle | healthcare_foundation | - | - |
| oracle | healthcare_foundation | - | - |
| oracle | healthcare_translational_research | - | - |
| oracle | healthcare_translational_research | - | - |
| oracle | healthcare_translational_research | - | - |
| oracle | healthcare_translational_research | - | - |
| oracle | healthcare_translational_research | - | - |
| oracle | hospitality_guest_access | - | - |
| oracle | hospitality_guest_access | - | - |
| oracle | hospitality_materials_control | - | - |
| oracle | hospitality_simphony | 19.1.0 - 19.1.2 | - |
| oracle | hospitality_simphony | - | - |
| oracle | hospitality_simphony | - | - |
| oracle | identity_manager | - | - |
| oracle | insurance_accounting_analyzer | - | - |
| oracle | insurance_allocation_manager_for_enterprise_profitability | - | - |
| oracle | insurance_allocation_manager_for_enterprise_profitability | - | - |
| oracle | insurance_data_foundation | 8.0.4 - 8.0.7 | - |
| oracle | insurance_ifrs_17_analyzer | - | - |
| oracle | insurance_ifrs_17_analyzer | - | - |
| oracle | insurance_insbridge_rating_and_underwriting | 5.0.0.0 - 5.6.0.0 | - |
| oracle | insurance_insbridge_rating_and_underwriting | - | - |
| oracle | insurance_performance_insight | - | - |
| oracle | jd_edwards_enterpriseone_tools | - | - |
| oracle | jdeveloper | - | - |
| oracle | jdeveloper | - | - |
| oracle | jdeveloper | - | - |
| oracle | jdeveloper_and_adf | - | - |
| oracle | jdeveloper_and_adf | - | - |
| oracle | jdeveloper_and_adf | - | - |
| oracle | knowledge | 8.6.0 - 8.6.3 | - |
| oracle | peoplesoft_enterprise_peopletools | - | - |
| oracle | peoplesoft_enterprise_peopletools | - | - |
| oracle | peoplesoft_enterprise_peopletools | - | - |
| oracle | peoplesoft_enterprise_peopletools | - | - |
| oracle | policy_automation | 12.2.0 - 12.2.15 | - |
| oracle | policy_automation | - | - |
| oracle | policy_automation | - | - |
| oracle | policy_automation | - | - |
| oracle | policy_automation_connector_for_siebel | - | - |
| oracle | policy_automation_for_mobile_devices | 12.2.0 - 12.2.15 | - |
| oracle | primavera_gateway | 16.2.0 - 16.2.11 | - |
| oracle | primavera_gateway | 17.12.0 - 17.12.7 | - |
| oracle | primavera_gateway | 18.8.0 - 18.8.9 | - |
| oracle | primavera_gateway | 19.12.0 - 19.12.4 | - |
| oracle | primavera_gateway | - | - |
| oracle | primavera_unifier | 17.7 - 17.12 | - |
| oracle | primavera_unifier | - | - |
| oracle | primavera_unifier | - | - |
| oracle | primavera_unifier | - | - |
| oracle | real-time_scheduler | 2.3.0.1 - 2.3.0.3 | - |
| oracle | rest_data_services | - | - |
| oracle | rest_data_services | - | - |
| oracle | rest_data_services | - | - |
| oracle | rest_data_services | - | - |
| oracle | rest_data_services | - | - |
| oracle | retail_back_office | - | - |
| oracle | retail_back_office | - | - |
| oracle | retail_central_office | - | - |
| oracle | retail_central_office | - | - |
| oracle | retail_customer_insights | - | - |
| oracle | retail_customer_insights | - | - |
| oracle | retail_customer_management_and_segmentation_foundation | - | - |
| oracle | retail_customer_management_and_segmentation_foundation | - | - |
| oracle | retail_point-of-service | - | - |
| oracle | retail_point-of-service | - | - |
| oracle | retail_returns_management | - | - |
| oracle | retail_returns_management | - | - |
| oracle | service_bus | - | - |
| oracle | service_bus | - | - |
| oracle | service_bus | - | - |
| oracle | siebel_mobile_applications | 19.8 | - |
| oracle | siebel_ui_framework | - | - |
| oracle | storagetek_tape_analytics_sw_tool | - | - |
| oracle | system_utilities | - | - |
| oracle | tape_library_acsls | - | - |
| oracle | tape_library_acsls | - | - |
| oracle | transportation_management | - | - |
| oracle | utilities_mobile_workforce_management | 2.3.0.1 - 2.3.0.3 | - |
| oracle | webcenter_sites | - | - |
| oracle | weblogic_server | - | - |
| oracle | weblogic_server | - | - |
| oracle | weblogic_server | - | - |
| oracle | weblogic_server | - | - |
| oracle | weblogic_server | - | - |
| joomla | joomla\! | 3.0.0 - 3.9.4 | - |
| juniper | junos | - | - |
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Exploitability
Impact