The vulnerability of the setObject function in the dojo library, allowing a hacker to execute arbitrary code

🗓️ 02 Sep 2022 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 1 Views

The dojo library setObject vulnerability allows remote code execution due to incorrect code generation.

Reporter	Title	Published	Views	Family All 136
IBM Security Bulletins	Security Bulletin: IBM PowerVM Novalink is vulnerable because Dojo cloud allow a remote attacker to execute arbitrary code on the system due to WebSphere Liberty. (CVE-2021-23450)	27 Apr 202211:32	–	ibm
IBM Security Bulletins	Security Bulletin: IBM WebSphere Application Server shipped with IBM Security Guardium Key Lifecycle Manager (SKLM) is vulnerable to remote code execution due to Dojo (CVE-2021-23450)	13 Apr 202209:57	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Master Data Management is vulnerable to prototype pollution from vulnerability found in Dojo (CVE-2021-23450)	19 Nov 202414:05	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities have been identified in IBM WebSphere Application Server Liberty shipped with IBM® Intelligent Operations Center [CVE-2021-23450]	13 Sep 202205:52	–	ibm
IBM Security Bulletins	Security Bulletin: IBM CICS TX Standard is vulnerable to arbitrary code execution due to IBM WebSphere Application Server Liberty (CVE-2021-23450)	14 Feb 202321:14	–	ibm
IBM Security Bulletins	Security Bulletin: IBM WebSphere Application Server shipped with IBM WebSphere Application Server Patterns is vulnerable to remote code execution due to Dojo (CVE-2021-23450)	6 May 202221:47	–	ibm
IBM Security Bulletins	Security Bulletin: Security vulnerabilities have been identified in IBM WebSphere Application Server shipped with IBM Tivoli Federated Identity Manager	5 May 202219:13	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to arbitrary code execution with IBM WebSphere Application Server (CVE-2021-23450).	12 Jan 202321:59	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Planning Analytics Workspace is affected by security vulnerabilities	7 Apr 202219:34	–	ibm
IBM Security Bulletins	Security Bulletin: CP4D Match 360 is vulnerable to remote attacker executing arbitrary code within IBM WebSphere Application Server Liberty (CVE-2021-23450)	6 Jun 202214:54	–	ibm

Vulners

Node

oracle primavera_unifierMatch18.8

OR

oracle weblogic_serverMatch12.2.1.4.0

OR

oracle primavera_unifierMatch19.12

OR

oracle primavera_unifierRange17.7–17.12

OR

oracle weblogic_serverMatch14.1.1.0.0

OR

oracle primavera_unifierMatch20.12

OR

oracle oracle_communications_policy_managementMatch12.6.0.0.0

OR

oracle primavera_unifierMatch21.12

OR

ibm ibm_security_guardium_key_lifecycle_managerRange<4.1.1-iss-sklm-fp0006

OR

ibm ibm_cloud_pak_systemRange<2.3.3.5

Source	Link
oracle	www.oracle.com/security-alerts/cpujul2022.html
oracle	www.oracle.com/security-alerts/cpuapr2022.html
ibm	www.ibm.com/support/pages/node/6614509
ibm	www.ibm.com/support/pages/node/6612587
snyk	www.snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-2313036
snyk	www.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-2313035
snyk	www.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBDOJO-2313034
snyk	www.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2313033
snyk	www.snyk.io/vuln/SNYK-JS-DOJO-1535223
xn--80ahaefyxhn	www.xn--80ahaefyxhn.xn--j1afgaq.xn--p1ai/bin/view/%D0%9E%D0%A1%D0%BD%D0%BE%D0%B2%D0%B0/%D0%9E%D0%B1%D0%BD%D0%BE%D0%B2%D0%BB%D0%B5%D0%BD%D0%B8%D1%8F/2.7/

04 Apr 2023 00:00Current

7.3High risk

Vulners AI Score7.3

CVSS 39.8

CVSS 210

EPSS0.30367

dojo library setObject vulnerability remote code execution incorrect code generation