Detections
Analytics
jQuery < 3.4.0 Prototype Pollution
medium Web App Scanning Plugin ID 98590
Language:
Synopsis
jQuery < 3.4.0 Prototype PollutionDescription
According to its self-reported version number, jQuery is prior to 3.4.0. Therefore, it may be affected by a prototype pollution vulnerability due to 'extend' function that can be tricked into modifying the prototype of 'Object'.Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.
Solution
Upgrade to jQuery version 3.4.0 or later.See Also
Plugin Details
Severity: Medium
ID: 98590
Type: remote
Family: Component Vulnerability
Published: 4/25/2019
Updated: 3/14/2023
Scan Template: basic, full, pci, scan
Risk Information
VPR
Risk Factor: Medium
Score: 4.6
CVSS v2
Risk Factor: Medium
Base Score: 4.3
Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N
CVSS Score Source: CVE-2019-11358
CVSS v3
Risk Factor: Medium
Base Score: 6.1
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS Score Source: CVE-2019-11358
Vulnerability Information
CPE: cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 4/20/2019
Vulnerability Publication Date: 4/20/2019
Reference Information
CVE: CVE-2019-11358
BID: 108023
OWASP: 2010-A2, 2010-A4, 2013-A3, 2013-A4, 2013-A9, 2017-A5, 2017-A7, 2017-A9, 2021-A3, 2021-A6
WASC: Cross-Site Scripting, Denial of Service, Improper Input Handling
CAPEC: 1, 10, 101, 104, 108, 109, 110, 120, 13, 135, 136, 14, 147, 153, 180, 182, 197, 209, 22, 23, 230, 231, 24, 250, 261, 267, 28, 3, 31, 42, 43, 45, 46, 47, 473, 492, 52, 53, 588, 591, 592, 63, 64, 67, 7, 71, 72, 73, 77, 78, 79, 8, 80, 81, 83, 85, 88, 9
DISA STIG: APSC-DV-002400, APSC-DV-002490, APSC-DV-002560, APSC-DV-002630
HIPAA: 164.306(a)(1), 164.306(a)(2), 164.312(a)(1), 164.312(e)
ISO: 27001-A.12.6.1, 27001-A.13.1.3, 27001-A.13.2.1, 27001-A.14.1.2, 27001-A.14.1.3, 27001-A.14.2.5
NIST: sp800_53-AC-4, sp800_53-CM-6b, sp800_53-SC-5, sp800_53-SI-10
OWASP API: 2019-API7, 2023-API8
OWASP ASVS: 4.0.2-14.2.1, 4.0.2-5.1.3, 4.0.2-5.3.1, 4.0.2-5.3.3