Object Prototype Pollution in jQuery Used by Drupal and Backdrop CMS
CVE-2019-11358
6.1MEDIUM
Key Information:
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2019-11358?
A vulnerability exists in versions of jQuery before 3.4.0, as utilized in Drupal and Backdrop CMS, where improper handling of Object.prototype can lead to prototype pollution. Specifically, if an unsanitized source object contains an enumerable proto property, it allows attackers to modify the native Object.prototype, potentially impacting the behavior of JavaScript objects in the affected applications. This issue can be leveraged to execute arbitrary code and cause further exploitation within web applications.
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.