GitHub Advisoryadvisory · npm

GHSA-536q-8gxx-m782 Cross-Site Scripting in dojo

MEDIUM Published 2019-09-11 Modified 2020-08-31 Official page ↗
Aliases
CVE-2010-2273
Ecosystem
npm
Packages
dojo
Severity
Moderate
Weaknesses
CWE-79
Reviewed
2019-09-04

Affected packages

• npm dojo: >= 1.13.0, < 1.13.1 → fixed in 1.13.1 • npm dojo: >= 1.12.0, < 1.12.4 → fixed in 1.12.4 • npm dojo: >= 1.11.0, < 1.11.6 → fixed in 1.11.6 • npm dojo: >= 1.10.0, < 1.10.10 → fixed in 1.10.10

Description

Versions of `dojo` prior to 1.4.2 are vulnerable to DOM-based Cross-Site Scripting (XSS). The package does not sanitize URL parameters in the `_testCommon.js` and `runner.html` test files, allowing attackers to execute arbitrary JavaScript in the victim's browser. Recommendation Upgrade to version 1.4.2 or later.

Related

Alias · CVE (1)

  • CVE-2010-2273 Multiple cross-site scripting (XSS) vulnerabilities in Dojo 1.0.x before 1.0.3, 1.1.x before 1.1.2, 1.2.x before 1.2.4, 1.3.x before 1.3.3,… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References