GitHub Advisory DatabaseGHSA-536Q-8GXX-M782Cross-Site Scripting in dojo
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:N/I:P/A:N
EPSS
Percentile
91.8%
Versions of dojo prior to 1.4.2 are vulnerable to DOM-based Cross-Site Scripting (XSS). The package does not sanitize URL parameters in the _testCommon.js and runner.html test files, allowing attackers to execute arbitrary JavaScript in the victim’s browser.
Recommendation
Upgrade to version 1.4.2 or later.
Affected configurations
References
bugs.dojotoolkit.org/ticket/10773
dojotoolkit.org/blog/post/dylan/2010/03/dojo-security-advisory/
secunia.com/advisories/38964
secunia.com/advisories/40007
www-01.ibm.com/support/docview.wss?uid=swg21431472
www-1.ibm.com/support/docview.wss?uid=swg1LO50833
www-1.ibm.com/support/docview.wss?uid=swg1LO50849
www-1.ibm.com/support/docview.wss?uid=swg1LO50856
www-1.ibm.com/support/docview.wss?uid=swg1LO50896
www-1.ibm.com/support/docview.wss?uid=swg1LO50932
www-1.ibm.com/support/docview.wss?uid=swg1LO50958
www-1.ibm.com/support/docview.wss?uid=swg1LO50994
www.gdssecurity.com/l/b/2010/03/12/multiple-dom-based-xss-in-dojo-toolkit-sdk/
www.vupen.com/english/advisories/2010/1281
bugs.dojotoolkit.org/ticket/10773
github.com/advisories/GHSA-536q-8gxx-m782
github.com/dojo/dojo/commit/9117ffd5a3863e44c92fcd58564c0da22be858f4
github.com/dojo/dojo/pull/307
nvd.nist.gov/vuln/detail/CVE-2010-2273
www.npmjs.com/advisories/972
Related
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:N/I:P/A:N
EPSS
Percentile
91.8%