CVE-2010-2273 Cross-Site Scripting in dojo
MediumCVSS 4.3
EPSS 4.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple cross-site scripting (XSS) vulnerabilities in Dojo 1.0.x before 1.0.3, 1.1.x before 1.1.2, 1.2.x before 1.2.4, 1.3.x before 1.3.3, and 1.4.x before 1.4.2 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, possibly related to dojo/resources/iframe_history.html, dojox/av/FLAudio.js, dojox/av/FLVideo.js, dojox/av/resources/audio.swf, dojox/av/resources/video.swf, util/buildscripts/jslib/build.js, and util/buildscripts/jslib/buildUtil.js, as demonstrated by the (1) dojoUrl and (2) testUrl parameters to util/doh/runner.html.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| npm dojo(npm) | = 1.13.0 | No fix listed |
| npm dojo(npm) | >= 1.12.0, < 1.12.4 | 1.12.4 |
| npm dojo(npm) | >= 1.11.0, < 1.11.6 | 1.11.6 |
| npm dojo(npm) | >= 1.10.0, < 1.10.10 | 1.10.10 |
| debian/dojo(Debian:12) | < 1.4.2+dfsg-1 | 1.4.2+dfsg-1 |
| debian/dojo(Debian:14) | < 1.4.2+dfsg-1 | 1.4.2+dfsg-1 |
| debian/dojo(Debian:13) | < 1.4.2+dfsg-1 | 1.4.2+dfsg-1 |
| dojotoolkit dojo | = 1.0 | No fix listed |
| dojotoolkit dojo | = 1.0.1 | No fix listed |
| dojotoolkit dojo | = 1.0.2 | No fix listed |
| dojotoolkit dojo | = 1.1 | No fix listed |
| dojotoolkit dojo | = 1.1.1 | No fix listed |
| dojotoolkit dojo | = 1.2 | No fix listed |
| dojotoolkit dojo | = 1.2.1 | No fix listed |
| dojotoolkit dojo | = 1.2.2 | No fix listed |
| dojotoolkit dojo | = 1.2.3 | No fix listed |
| dojotoolkit dojo | = 1.3 | No fix listed |
| dojotoolkit dojo | = 1.3.1 | No fix listed |
| dojotoolkit dojo | = 1.3.2 | No fix listed |
| dojotoolkit dojo | = 1.4 | No fix listed |
| dojotoolkit dojo | = 1.4.1 | No fix listed |
References
- github.com patch
- github.com patch
- bugs.dojotoolkit.org
- www.npmjs.com
- nvd.nist.gov third-party-advisory
- bugs.dojotoolkit.org exploit
- dojotoolkit.org patch vendor-advisory
- 38964 third-party-advisory vendor-advisory
- 40007 third-party-advisory vendor-advisory
- www-01.ibm.com
- LO50833 vendor-advisory
- LO50849 vendor-advisory
- LO50856 vendor-advisory
- LO50896 vendor-advisory
- LO50932 vendor-advisory
- LO50958 vendor-advisory
- LO50994 vendor-advisory
- www.gdssecurity.com exploit
- ADV-2010-1281 vdb-entry vendor-advisory
- github.com
- Debian Security Tracker CVE-2010-2273 vendor-advisory