Description

The default configuration of the build process in Dojo 0.4.x before 0.4.4, 1.0.x before 1.0.3, 1.1.x before 1.1.2, 1.2.x before 1.2.4, 1.3.x before 1.3.3, and 1.4.x before 1.4.2 has the copyTests=true and mini=false options, which makes it easier for remote attackers to have an unspecified impact via a request to a (1) test or (2) demo component.

Remediation

References

http://www-1.ibm.com/support/docview.wss?uid=swg1LO50994

http://www-01.ibm.com/support/docview.wss?uid=swg21431472

http://www-1.ibm.com/support/docview.wss?uid=swg1LO50958

http://www-1.ibm.com/support/docview.wss?uid=swg1LO50932

http://dojotoolkit.org/blog/post/dylan/2010/03/dojo-security-advisory/

http://www-1.ibm.com/support/docview.wss?uid=swg1LO50856

http://www-1.ibm.com/support/docview.wss?uid=swg1LO50896

http://www-1.ibm.com/support/docview.wss?uid=swg1LO50849

http://www-1.ibm.com/support/docview.wss?uid=swg1LO50833

http://secunia.com/advisories/38964

http://secunia.com/advisories/40007

http://www.vupen.com/english/advisories/2010/1281

Related Vulnerabilities

CVE-2020-15125 Vulnerability in npm package auth0

CVE-2020-7662 Vulnerability in npm package websocket-extensions

CVE-2023-46654 Vulnerability in maven package org.jenkins-ci.plugins:electricflow

CVE-2023-50772 Vulnerability in maven package com.zintow:dingding-json-pusher

CVE-2021-21266 Vulnerability in maven package org.openhab.addons.bundles:org.openhab.binding.homematic

Severity

Critical

Classification

CWE-16

Tags

Patch Vendor Advisory