GHSA-536q-8gxx-m782
Cross-Site Scripting in dojo
At a glance
- Published
- Updated
- CVE
- CVE-2010-2273
Description
Versions of `dojo` prior to 1.4.2 are vulnerable to DOM-based Cross-Site Scripting (XSS). The package does not sanitize URL parameters in the `_testCommon.js` and `runner.html` test files, allowing attackers to execute arbitrary JavaScript in the victim's browser. ## Recommendation Upgrade to version 1.4.2 or later.
Affected packages
| Package | Versions |
|---|---|
| npm · dojo | introduced 1.13.0, fixed 1.13.1 |
| npm · dojo | introduced 1.12.0, fixed 1.12.4 |
| npm · dojo | introduced 1.11.0, fixed 1.11.6 |
| npm · dojo | introduced 1.10.0, fixed 1.10.10 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2010-2273 ADVISORY
- https://github.com/dojo/dojo/pull/307 WEB
- https://github.com/dojo/dojo/commit/9117ffd5a3863e44c92fcd58564c0da22be858f4 WEB
- https://bugs.dojotoolkit.org/ticket/10773 WEB
- https://www.npmjs.com/advisories/972 WEB
- http://bugs.dojotoolkit.org/ticket/10773 WEB
- http://dojotoolkit.org/blog/post/dylan/2010/03/dojo-security-advisory WEB
- http://secunia.com/advisories/38964 WEB
- http://secunia.com/advisories/40007 WEB
- http://www-01.ibm.com/support/docview.wss?uid=swg21431472 WEB
- http://www-1.ibm.com/support/docview.wss?uid=swg1LO50833 WEB
- http://www-1.ibm.com/support/docview.wss?uid=swg1LO50849 WEB
- http://www-1.ibm.com/support/docview.wss?uid=swg1LO50856 WEB
- http://www-1.ibm.com/support/docview.wss?uid=swg1LO50896 WEB
- http://www-1.ibm.com/support/docview.wss?uid=swg1LO50932 WEB
- http://www-1.ibm.com/support/docview.wss?uid=swg1LO50958 WEB
- http://www-1.ibm.com/support/docview.wss?uid=swg1LO50994 WEB
- http://www.gdssecurity.com/l/b/2010/03/12/multiple-dom-based-xss-in-dojo-toolkit-sdk WEB
- http://www.vupen.com/english/advisories/2010/1281 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |