Description

In Dojo Toolkit before 1.14, there is unescaped string injection in dojox/Grid/DataGrid.

Remediation

References

https://dojotoolkit.org/blog/dojo-1-14-released

https://github.com/dojo/dojox/pull/283

https://lists.debian.org/debian-lts-announce/2018/09/msg00002.html

Related Vulnerabilities

CVE-2021-46063 Vulnerability in maven package net.mingsoft:ms-mcms

CVE-2023-38435 Vulnerability in maven package org.apache.felix:org.apache.felix.healthcheck.webconsoleplugin

CVE-2022-24818 Vulnerability in maven package org.geotools:gt-metadata

CVE-2023-34624 Vulnerability in maven package net.sourceforge.htmlcleaner:htmlcleaner

CVE-2022-36914 Vulnerability in maven package org.jenkins-ci.plugins:files-found-trigger

Severity

Critical

Classification

CWE-116 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Vendor Advisory Third Party Advisory