CVE-2010-2275 Cross-site scripting (XSS) vulnerability in dijit/tests/_testCommon.js in Dojo Toolkit SDK before 1.4.2 allows remote attackers to inject arbitrary web script or HTML via the theme parameter, as demon...
MediumCVSS 4.3
EPSS 2.9%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Cross-site scripting (XSS) vulnerability in dijit/tests/_testCommon.js in Dojo Toolkit SDK before 1.4.2 allows remote attackers to inject arbitrary web script or HTML via the theme parameter, as demonstrated by an attack against dijit/tests/form/test_Button.html.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| dojotoolkit dojo | <= 1.4.1 | No fix listed |
| dojotoolkit dojo | = 0.1.0 | No fix listed |
| dojotoolkit dojo | = 0.2.0 | No fix listed |
| dojotoolkit dojo | = 0.2.1 | No fix listed |
| dojotoolkit dojo | = 0.2.2 | No fix listed |
| dojotoolkit dojo | = 0.3.0 | No fix listed |
| dojotoolkit dojo | = 0.3.1 | No fix listed |
| dojotoolkit dojo | = 0.4.0 | No fix listed |
| dojotoolkit dojo | = 0.4.1 | No fix listed |
| dojotoolkit dojo | = 0.4.2 | No fix listed |
| dojotoolkit dojo | = 0.4.3 | No fix listed |
| dojotoolkit dojo | = 0.9.0 | No fix listed |
| dojotoolkit dojo | = 0.9.0-beta | No fix listed |
| dojotoolkit dojo | = 1.0 | No fix listed |
| dojotoolkit dojo | = 1.0.1 | No fix listed |
| dojotoolkit dojo | = 1.0.2 | No fix listed |
| dojotoolkit dojo | = 1.1 | No fix listed |
| dojotoolkit dojo | = 1.1.1 | No fix listed |
| dojotoolkit dojo | = 1.2 | No fix listed |
| dojotoolkit dojo | = 1.2.1 | No fix listed |
| dojotoolkit dojo | = 1.2.2 | No fix listed |
| dojotoolkit dojo | = 1.2.3 | No fix listed |
| dojotoolkit dojo | = 1.3 | No fix listed |
| dojotoolkit dojo | = 1.3.1 | No fix listed |
| dojotoolkit dojo | = 1.3.2 | No fix listed |
Show 4 more
| Product | Affected versions | Fixed in |
|---|---|---|
| dojotoolkit dojo | = 1.4 | No fix listed |
| debian/dojo(Debian:12) | < 1.4.2+dfsg-1 | 1.4.2+dfsg-1 |
| debian/dojo(Debian:13) | < 1.4.2+dfsg-1 | 1.4.2+dfsg-1 |
| debian/dojo(Debian:14) | < 1.4.2+dfsg-1 | 1.4.2+dfsg-1 |
References
- Debian Security Tracker CVE-2010-2275 vendor-advisory
- bugs.dojotoolkit.org exploit
- 38964 third-party-advisory vendor-advisory
- 40007 third-party-advisory vendor-advisory
- www-01.ibm.com
- LO50833 vendor-advisory
- LO50849 vendor-advisory
- LO50856 vendor-advisory
- LO50896 vendor-advisory
- LO50932 vendor-advisory
- LO50958 vendor-advisory
- LO50994 vendor-advisory
- www.gdssecurity.com exploit
- ADV-2010-1281 vdb-entry vendor-advisory