PGV-1928338

Disclosed on April 17, 2019 (updated May 11, 2026)

Vulnerability Overview

PGV-1928338 is a category 3 vulnerabilty that affects drupal/core, versions ≥ 8.0.0 & < 8.5.15, ≥ 8.6.0 & < 8.6.15

CVSS Scores:

Risk Assessment

customize

The risk assessment shows that this vulnerability is exlpoited by a compromised user. A legitimate user who unknowingly triggers exploitation of this vulnerability through normal interaction.

The impact is an environmental compromise. Exploitation can escape the application boundary and impact the host environment, infrastructure, or other services.

The threat damage is caused by a data breach (limited). Exploitation does not provide access to data beyond what the user is already authorized to access.is caused by data tampering (limited). Exploitation does not allow modification of data beyond what the user is already authorized to modify.

Vulnerability Details

The jQuery project released version 3.4.0, and as part of that, disclosed a security vulnerability that affects all prior versions. As described in their release notes:

jQuery 3.4.0 includes a fix for some unintended behavior when using jQuery.extend(true, , ...). If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Object.prototype. This fix is included in jQuery 3.4.0, but patch diffs exist to patch previous jQuery versions.

It's possible that this vulnerability is exploitable with some Drupal modules. As a precaution, this Drupal security release backports the fix to jQuery.extend(), without making any other changes to the jQuery version that is included in Drupal core (3.2.1 for Drupal 8 and 1.4.4 for Drupal 7) or running on the site via some other module such as jQuery Update.

2019-04-22, edited to add CVE.

Common Weakness Enumerations

CWE-1321 - Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

Additional References

Your Risk Profile

Network Exposure	External Accessable from the public internet
Access Interface	WebBrowser Primarily web-based applications
Service Outage	Disruptive Operations would be impacted
Data Breach	Disruptive Operations would be impacted
Data Tampering	Disruptive Operations would be impacted
Customize

Additional Identifiers

CVE-2019-11358
DRUPAL-CORE-2019-006