CVE-2010-2274 Dojo Open Redirect vulnerability
MediumCVSS 4.3
EPSS 1.9%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple open redirect vulnerabilities in Dojo 1.0.x before 1.0.3, 1.1.x before 1.1.2, 1.2.x before 1.2.4, 1.3.x before 1.3.3, and 1.4.x before 1.4.2 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors, possibly related to dojo/resources/iframe_history.html, dojox/av/FLAudio.js, dojox/av/FLVideo.js, dojox/av/resources/audio.swf, dojox/av/resources/video.swf, util/buildscripts/jslib/build.js, util/buildscripts/jslib/buildUtil.js, and util/doh/runner.html.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.dojotoolkit/dojo(Maven) | >= 1.0.0, < 1.0.3 | 1.0.3 |
| org.dojotoolkit/dojo(Maven) | >= 1.1.0, < 1.1.2 | 1.1.2 |
| org.dojotoolkit/dojo(Maven) | = 1.1.1 | No fix listed |
| org.dojotoolkit/dojo(Maven) | >= 1.2.0, < 1.2.4 | 1.2.4 |
| org.dojotoolkit/dojo(Maven) | = 1.2.0 | No fix listed |
| org.dojotoolkit/dojo(Maven) | = 1.2.3 | No fix listed |
| org.dojotoolkit/dojo(Maven) | >= 1.3.0, < 1.3.3 | 1.3.3 |
| org.dojotoolkit/dojo(Maven) | = 1.3.0 | No fix listed |
| org.dojotoolkit/dojo(Maven) | = 1.3.1 | No fix listed |
| org.dojotoolkit/dojo(Maven) | = 1.3.2 | No fix listed |
| org.dojotoolkit/dojo(Maven) | >= 1.4.0, < 1.4.2 | 1.4.2 |
| dojotoolkit dojo | = 1.0 | No fix listed |
| dojotoolkit dojo | = 1.0.1 | No fix listed |
| dojotoolkit dojo | = 1.0.2 | No fix listed |
| dojotoolkit dojo | = 1.1 | No fix listed |
| dojotoolkit dojo | = 1.1.1 | No fix listed |
| dojotoolkit dojo | = 1.2 | No fix listed |
| dojotoolkit dojo | = 1.2.1 | No fix listed |
| dojotoolkit dojo | = 1.2.2 | No fix listed |
| dojotoolkit dojo | = 1.2.3 | No fix listed |
| dojotoolkit dojo | = 1.3 | No fix listed |
| dojotoolkit dojo | = 1.3.1 | No fix listed |
| dojotoolkit dojo | = 1.3.2 | No fix listed |
| dojotoolkit dojo | = 1.4 | No fix listed |
| dojotoolkit dojo | = 1.4.1 | No fix listed |
Show 3 more
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/dojo(Debian:12) | < 1.4.2+dfsg-1 | 1.4.2+dfsg-1 |
| debian/dojo(Debian:13) | < 1.4.2+dfsg-1 | 1.4.2+dfsg-1 |
| debian/dojo(Debian:14) | < 1.4.2+dfsg-1 | 1.4.2+dfsg-1 |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com product
- web.archive.org
- web.archive.org
- dojotoolkit.org patch vendor-advisory
- www-01.ibm.com
- LO50833 vendor-advisory
- LO50849 vendor-advisory
- LO50856 vendor-advisory
- LO50896 vendor-advisory
- LO50932 vendor-advisory
- LO50958 vendor-advisory
- LO50994 vendor-advisory
- github.com
- 38964 third-party-advisory vendor-advisory
- 40007 third-party-advisory vendor-advisory
- ADV-2010-1281 vdb-entry vendor-advisory
- Debian Security Tracker CVE-2010-2274 vendor-advisory