GitHub Advisoryadvisory · npm

GHSA-cxjc-r2fp-7mq6 Cross-site Scripting in dijit editor's LinkDialog plugin

LOW Published 2020-06-15 Modified 2023-03-01 Official page ↗
Aliases
CVE-2020-4051
Ecosystem
npm
Packages
dijit
Severity
Low
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2020-06-15

Affected packages

• npm dijit: < 1.11.11 → fixed in 1.11.11 • npm dijit: >= 1.12.0, < 1.12.9 → fixed in 1.12.9 • npm dijit: >= 1.13.0, < 1.13.8 → fixed in 1.13.8 • npm dijit: >= 1.14.0, < 1.14.7 → fixed in 1.14.7 • npm dijit: >= 1.15.0, < 1.15.4 → fixed in 1.15.4 • npm dijit: >= 1.16.0, < 1.16.3 → fixed in 1.16.3

Description

Impact XSS possible for users of the Dijit Editor's LinkDialog plugin Patches Yes, 1.11.11, 1.12.9, 1.13.8, 1.14.7, 1.15.4, 1.16.3 Workarounds Users may apply the patch made in these releases. For more information If you have any questions or comments about this advisory, open an issue in dojo/dijit

Related

Alias · CVE (1)

  • CVE-2020-4051 In Dijit before versions 1.11.11, and greater than or equal to 1.12.0 and less than 1.12.9, and greater than or equal to 1.13.0 and less… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References