CVE-2019-11358: Backdropcms Backdrop

Medium severity, CVSS 6.1. EPSS: 86.8% chance of exploitation in the next 30 days.

jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Object.prototype.

Affected products

Backdropcms Backdrop: from 1.11.0, before 1.11.9 (fixed in 1.11.9); from 1.12.0, before 1.12.6 (fixed in 1.12.6)
Debian Debian Linux: version 8.0 only; version 9.0 only; version 10.0 only
Drupal Drupal: from 7.0, before 7.66 (fixed in 7.66); from 8.5.0, before 8.5.15 (fixed in 8.5.15); from 8.6.0, before 8.6.15 (fixed in 8.6.15)
Fedoraproject Fedora: version 28 only; version 29 only; version 30 only
Joomla! Joomla!: from 3.0.0, up to and including 3.9.4
jQuery jQuery: before 3.4.0 (fixed in 3.4.0)
Juniper Junos: version 21.2 only
Netapp Oncommand System Manager: from 3.0, up to and including 3.1.3
Netapp Snapcenter: affected versions not specified
Opensuse Backports Sle: version 15.0 only
Opensuse Leap: version 15.1 only
Oracle Agile Product Lifecycle Management For Process: version 6.1 only; version 6.2.0.0 only; version 6.2.1.0 only; version 6.2.2.0 only; version 6.2.3.0 only
Oracle Application Express: before 19.1 (fixed in 19.1)
Oracle Application Service Level Management: version 13.2.0.0 only; version 13.3.0.0 only
Oracle Application Testing Suite: version 12.5.0.3 only; version 13.1.0.1 only; version 13.2 only; version 13.2.0.1 only; version 13.3 only; version 13.3.0.1 only
Oracle Banking Digital Experience: version 18.1 only; version 18.2 only; version 18.3 only; version 19.1 only; version 19.2 only; version 20.1 only
Oracle Banking Enterprise Collections: from 2.7.0, up to and including 2.8.0
Oracle Banking Platform: from 2.4.0, up to and including 2.10.0
Oracle BI Publisher: version 5.5.0.0.0 only; version 12.2.1.3.0 only; version 12.2.1.4.0 only
Oracle Big Data Discovery: version 1.6 only
Oracle Business Process Management Suite: version 12.2.1.3.0 only; version 12.2.1.4.0 only
Oracle Communications Analytics: version 12.1.1 only
Oracle Communications Application Session Controller: version 3.8m0 only
Oracle Communications Billing And Revenue Management: version 7.5 only; version 7.5.0.23.0 only; version 12.0 only; version 12.0.0.3.0 only
Oracle Communications Diameter Signaling Router: version 8.0.0 only; version 8.1 only; version 8.2 only; version 8.2.1 only
and 80 more

Published 2019-04-20. Last modified 2026-06-17.