{
"id": "GHSA-wv67-q8rr-grjp",
"aliases": [
"CVE-2019-5428"
],
"details": "## Duplicate Advisory\nThis advisory is a duplicate of [GHSA-6c3j-c64m-qhgq](https://github.com/advisories/GHSA-6c3j-c64m-qhgq). This link is maintained to preserve external references.\n\n## Original Description\nVersions of `jquery` prior to 3.4.0 are vulnerable to Prototype Pollution. The extend() method allows an attacker to modify the prototype for `Object` causing changes in properties that will exist on all objects.\n\n## Recommendation\nUpgrade to version 3.4.0 or later.",
"summary": "Duplicate Advisory: Prototype Pollution in jquery",
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.4.0"
}
]
}
],
"package": {
"name": "jquery",
"ecosystem": "npm"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.4.0"
}
]
}
],
"package": {
"name": "jquery",
"ecosystem": "NuGet"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.4.0"
}
]
}
],
"package": {
"name": "org.webjars.npm:jquery",
"ecosystem": "Maven"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.4.0"
}
]
}
],
"package": {
"name": "jquery-rails",
"ecosystem": "RubyGems"
}
}
],
"modified": "2022-10-06T17:19:37Z",
"severity": [],
"published": "2019-04-23T15:59:10Z",
"withdrawn": "2019-04-26T14:50:56Z",
"references": [
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5428",
"type": "ADVISORY"
},
{
"url": "https://github.com/jquery/jquery/pull/4333",
"type": "WEB"
},
{
"url": "https://hackerone.com/reports/454365",
"type": "WEB"
},
{
"url": "https://blog.jquery.com/2019/04/10/jquery-3-4-0-released",
"type": "WEB"
},
{
"url": "https://www.npmjs.com/advisories/796",
"type": "WEB"
}
],
"schema_version": "1.4.0",
"database_specific": {
"cwe_ids": [],
"severity": "MODERATE",
"github_reviewed": true,
"nvd_published_at": null,
"github_reviewed_at": "2019-04-23T15:57:18Z"
}
}