Description

dojox is vulnerable to Cross-site Scripting in all versions before version 1.16.1, 1.15.2, 1.14.5, 1.13.6, 1.12.7 and 1.11.9. This is due to dojox.xmpp.util.xmlEncode only encoding the first occurrence of each character, not all of them.

Remediation

References

https://github.com/dojo/dojox/security/advisories/GHSA-pg97-ww7h-5mjr

https://lists.debian.org/debian-lts-announce/2020/02/msg00033.html

https://snyk.io/vuln/SNYK-JS-DOJOX-548257%2C

Related Vulnerabilities

CVE-2022-1243 Vulnerability in maven package org.webjars.bower:urijs

CVE-2020-12265 Vulnerability in maven package org.webjars.npm:decompress

CVE-2021-3780 Vulnerability in npm package peertube

CVE-2021-23639 Vulnerability in npm package md-to-pdf

CVE-2020-7792 Vulnerability in npm package mout

Severity

High

Classification

CWE-79 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Tags

Exploit Third Party Advisory Mailing List