Lucene search

GoogleOSV:GHSA-536Q-8GXX-M782

HistorySep 11, 2019 - 11:02 p.m.

Cross-Site Scripting in dojo

2019-09-1123:02:57

Google

osv.dev

0.042 Low

EPSS

Percentile

92.3%

JSON

Versions of dojo prior to 1.4.2 are vulnerable to DOM-based Cross-Site Scripting (XSS). The package does not sanitize URL parameters in the _testCommon.js and runner.html test files, allowing attackers to execute arbitrary JavaScript in the victim’s browser.

Recommendation

Upgrade to version 1.4.2 or later.

CPENameOperatorVersion
dojoeq1.13.0
dojoge1.12.0
dojolt1.10.10
dojoge1.11.0
dojolt1.12.4
dojoge1.10.0
dojolt1.11.6

Name	Operator	Version
dojo	eq	1.13.0
dojo	ge	1.12.0
dojo	lt	1.10.10
dojo	ge	1.11.0
dojo	lt	1.12.4
dojo	ge	1.10.0
dojo	lt	1.11.6

References

bugs.dojotoolkit.org/ticket/10773

dojotoolkit.org/blog/post/dylan/2010/03/dojo-security-advisory

secunia.com/advisories/38964

secunia.com/advisories/40007

www-01.ibm.com/support/docview.wss?uid=swg21431472

www-1.ibm.com/support/docview.wss?uid=swg1LO50833

www-1.ibm.com/support/docview.wss?uid=swg1LO50849

www-1.ibm.com/support/docview.wss?uid=swg1LO50856

www-1.ibm.com/support/docview.wss?uid=swg1LO50896

www-1.ibm.com/support/docview.wss?uid=swg1LO50932

www-1.ibm.com/support/docview.wss?uid=swg1LO50958

www-1.ibm.com/support/docview.wss?uid=swg1LO50994

www.gdssecurity.com/l/b/2010/03/12/multiple-dom-based-xss-in-dojo-toolkit-sdk

www.vupen.com/english/advisories/2010/1281

bugs.dojotoolkit.org/ticket/10773

github.com/dojo/dojo/commit/9117ffd5a3863e44c92fcd58564c0da22be858f4

github.com/dojo/dojo/pull/307

nvd.nist.gov/vuln/detail/CVE-2010-2273

www.npmjs.com/advisories/972

0.042 Low

EPSS

Percentile

92.3%

JSON

Related for OSV:GHSA-536Q-8GXX-M782