Description

dojox is vulnerable to Cross-site Scripting in all versions before version 1.16.1, 1.15.2, 1.14.5, 1.13.6, 1.12.7 and 1.11.9. This is due to dojox.xmpp.util.xmlEncode only encoding the first occurrence of each character, not all of them.

Remediation

References

https://github.com/dojo/dojox/security/advisories/GHSA-pg97-ww7h-5mjr

https://lists.debian.org/debian-lts-announce/2020/02/msg00033.html

https://snyk.io/vuln/SNYK-JS-DOJOX-548257%2C

Related Vulnerabilities

CVE-2023-40185 Vulnerability in npm package shescape

CVE-2020-28270 Vulnerability in npm package object-hierarchy-access

CVE-2021-27807 Vulnerability in maven package org.apache.pdfbox:pdfbox

CVE-2017-16172 Vulnerability in npm package section2.madisonjbrooks12

CVE-2020-28847 Vulnerability in npm package valine

Severity

High

Classification

CWE-79 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Tags

Exploit Third Party Advisory Mailing List