GitHub Advisoryadvisory · npm
GHSA-84cm-x2q5-8225 dojox vulnerable to unescaped string injection
CRITICAL
Official page ↗
- Aliases
- CVE-2018-15494
- Ecosystem
- npm
- Packages
- dojox
- Severity
- Critical
- CVSS vector
- CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-116
- Reviewed
- 2020-06-16
Affected packages
• npm dojox: < 1.14.0 → fixed in 1.14.0
Description
In Dojo Toolkit before 1.14.0, there is unescaped string injection in dojox/Grid/DataGrid.
Related
Alias · CVE (1)
- CVE-2018-15494 In Dojo Toolkit before 1.14, there is unescaped string injection in dojox/Grid/DataGrid. vulnerability
Weakness · CWE (1)
- CWE-116 Improper Encoding or Escaping of Output weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2018-15494 advisory
- https://github.com/dojo/dojox/pull/283 web
- https://dojotoolkit.org/blog/dojo-1-14-released web
- https://github.com/advisories/GHSA-84cm-x2q5-8225 advisory
- https://github.com/dojo/dojox package
- https://lists.debian.org/debian-lts-announce/2018/09/msg00002.html web