PT-2019-17660 · Jquery · Jquery

Published 2019-04-22 · Updated 2019-04-25 · CVE-2019-5428

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions jquery versions prior to 3.4.0

Description The issue concerns Prototype Pollution, where the extend() method allows an attacker to modify the prototype for Object, causing changes in properties that will exist on all objects.

Recommendations Upgrade to version 3.4.0 or later.

Related Identifiers

CVE-2019-5428

GHSA-WV67-Q8RR-GRJP

Affected Products

Jquery

References · 9

• https://osv.dev/vulnerability/GHSA-wv67-q8rr-grjp · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2019-5428 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-5428 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-5428 · Security Note
• https://ubuntu.com/security/CVE-2019-5428 · Vendor Advisory
• https://github.com/jquery/jquery/pull/4333 · Note
• https://blog.jquery.com/2019/04/10/jquery-3-4-0-released · Note
• https://hackerone.com/reports/454365 · Note
• https://npmjs.com/advisories/796 · Note