CVE-2019-11358observed exploitation

CVE-2019-11358

Published · Updated

Follow this CVE+ Monitor mediawiki+ Monitor django

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

72Vexday Risk Score

Prioritize patching. It exploitation observed by VulnCheck and has a public proof of concept.

ssvc Actepss 87%
from disclosure to weaponsame day
Published on NVDApr 19
1st PoCMar 30
VulnCheck+643d
What the vendors declare (VEX)

Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.

Red HatVEX document ↗
Affected
12 products (238 components)
Red Hat Enterprise Linux 7 · Red Hat Enterprise Linux 6 · Red Hat Software Collections · Red Hat OpenStack Platform 9 (Mitaka) · Red Hat OpenStack Platform 10 (Newton) · and others 7
no_fix_planned: Will not fix
Fixed
29 products (541 components)
Red Hat Enterprise Linux AppStream (v. 8) · Red Hat OpenShift Container Platform 3.11 · CloudForms Management Engine 5.10 · Red Hat Enterprise Linux Server (v. 7) · Red Hat Enterprise Linux Workstation (v. 7) · and others 24
fix ↗
Not affected
13 products (2,624 components) — because the vulnerable code is not present in the product
Red Hat JBoss Enterprise Application Platform 7.4.9 · Red Hat OpenShift Container Platform 4.6 · Red Hat JBoss EAP 7.4 for RHEL 7 Server · Red Hat JBoss EAP 7.4 for RHEL 8 · Red Hat JBoss EAP 7.4 for RHEL 9 · and others 8
jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Object.prototype.
Affected products
n/a · n/a
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.