# Use of JavaScript Library with Known Vulnerability **URL:** \ **Category:** Kibana\ **Created:** [June 18, 2019, 9:21am UTC](https://discuss.elastic.co/t/use-of-javascript-library-with-known-vulnerability/186211 "2019-06-18T09:21:56Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![Varun\_S](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/varun_s/32/48294_2.png) [@Varun\_S](https://discuss.elastic.co/u/Varun_S)\ **Post date:** [June 18, 2019, 9:21am UTC](https://discuss.elastic.co/t/use-of-javascript-library-with-known-vulnerability/186211/1 "2019-06-18T09:21:56Z")
Hi, We have done Qualys Was Security Test on Kibana [version 6.6.1]and we are **getting use of JavaScript Library with Known Vulnerability**. **Description of Vulnerability :-** Vulnerable javascript library: jQuery version: 3.3.1 Details: CVE-2019-11358: jQuery versions below 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. An unsanitized source object containing an enumerable **proto** property could extend the native Object.prototype. Please refer following resources for more details: [https://blog.jquery.com/2019/04/10/jquery-3-4-0-](https://blog.jquery.com/2019/04/10/jquery-3-4-0-) released/, [https://nvd.nist.gov/vuln/detail/CVE-2019-11358](https://nvd.nist.gov/vuln/detail/CVE-2019-11358), [https://github.com/jquery/jquery/commit/753d591aea698e57d6db58c9f722cd0808619b1b](https://github.com/jquery/jquery/commit/753d591aea698e57d6db58c9f722cd0808619b1b), [https://nvd.nist.gov/vuln/detail/CVE-2019-11358](https://nvd.nist.gov/vuln/detail/CVE-2019-11358). Found on the following pages (only first 10 pages are reported): [https://xx.xx.xx.xxx:5601/login?nextUrl=%2F#?\_g=()](https://xx.xx.xx.xxx:5601/login?nextUrl=%2F#?_g=()) [https://xx.xx.xx.xxx:5601/login?nextUrl=%2F%7B%7Bui.brandimage%7D%7D](https://xx.xx.xx.xxx:5601/login?nextUrl=%2F%257B%257Bui.brandimage%257D%257D) [https://xx.xx.xx.xxx:5601/app/kibana#/discover?\_g=()](https://xx.xx.xx.xxx:5601/app/kibana#/discover?_g=()) [https://xx.xx.xx.xxx:5601/app/kibana#/visualize?\_g=()](https://xx.xx.xx.xxx:5601/app/kibana#/visualize?_g=()) [https://xx.xx.xx.xxx:5601/app/kibana#/dashboards?\_g=()](https://xx.xx.xx.xxx:5601/app/kibana#/dashboards?_g=()) [https://xx.xx.xx.xxx:5601/app/timelion](https://xx.xx.xx.xxx:5601/app/timelion) [https://xx.xx.xx.xxx:5601/app/kibana#/dev\_tools?\_g=()](https://xx.xx.xx.xxx:5601/app/kibana#/dev_tools?_g=()) [https://xx.xx.xx.xxx:5601/app/kibana#/management?\_g=()](https://xx.xx.xx.xxx:5601/app/kibana#/management?_g=()) [https://xx.xx.xx.xxx:5601/login?nextUrl=%2F](https://xx.xx.xx.xxx:5601/login?nextUrl=%2F) [https://xx.xx.xx.xxx:5601/login?nextUrl=%2Fapp%2Fkibana](https://xx.xx.xx.xxx:5601/login?nextUrl=%2Fapp%2Fkibana) Can you please help us to resolve this issue. ---
**Author:** ![christophilus](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christophilus/32/42991_2.png) [@christophilus](https://discuss.elastic.co/u/christophilus)\ **Post date:** [July 2, 2019, 6:35pm UTC](https://discuss.elastic.co/t/use-of-javascript-library-with-known-vulnerability/186211/2 "2019-07-02T18:35:23Z")
The latest version of Kibana is currently on jQuery 3.4.1. I'm not sure what our patching policy is, but I will ask the security team. ---
**Author:** ![christophilus](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christophilus/32/42991_2.png) [@christophilus](https://discuss.elastic.co/u/christophilus)\ **Post date:** [July 2, 2019, 6:36pm UTC](https://discuss.elastic.co/t/use-of-javascript-library-with-known-vulnerability/186211/3 "2019-07-02T18:36:03Z")
My advice would be to upgrade to Kibana 7.x or at least to the latest 6.x. ---
**Author:** ![Brandon\_Kobel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/brandon_kobel/32/14829_2.png) [@Brandon\_Kobel](https://discuss.elastic.co/u/Brandon_Kobel)\ **Post date:** [July 3, 2019, 9:13pm UTC](https://discuss.elastic.co/t/use-of-javascript-library-with-known-vulnerability/186211/4 "2019-07-03T21:13:49Z")
Hey @Varun_S, for security reports like these in the future please send an e-mail to [security@elastic.co](mailto:security@elastic.co) per [https://www.elastic.co/community/security](https://www.elastic.co/community/security). Our usages of jQuery in Kibana weren't vulnerable to this CVE, but we've upgraded jQuery to 3.4.1 starting in Kibana 7.2.0 to prevent vulnerability scanners from reporting this issue. ---
**Author:** ![Varun\_S](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/varun_s/32/48294_2.png) [@Varun\_S](https://discuss.elastic.co/u/Varun_S)\ **Post date:** [July 4, 2019, 6:32am UTC](https://discuss.elastic.co/t/use-of-javascript-library-with-known-vulnerability/186211/5 "2019-07-04T06:32:48Z")
Thanks @christophilus ---
**Author:** ![Varun\_S](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/varun_s/32/48294_2.png) [@Varun\_S](https://discuss.elastic.co/u/Varun_S)\ **Post date:** [July 4, 2019, 6:33am UTC](https://discuss.elastic.co/t/use-of-javascript-library-with-known-vulnerability/186211/6 "2019-07-04T06:33:41Z")
Thanks @Brandon_Kobel... I will upgrade kibana and will run the Scan. ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [July 4, 2019, 9:09am UTC](https://discuss.elastic.co/t/use-of-javascript-library-with-known-vulnerability/186211/7 "2019-07-04T09:09:58Z")
You will need to upgrade the entire stack. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [August 1, 2019, 9:10am UTC](https://discuss.elastic.co/t/use-of-javascript-library-with-known-vulnerability/186211/8 "2019-08-01T09:10:06Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.