Description

dojox is vulnerable to Cross-site Scripting in all versions before version 1.16.1, 1.15.2, 1.14.5, 1.13.6, 1.12.7 and 1.11.9. This is due to dojox.xmpp.util.xmlEncode only encoding the first occurrence of each character, not all of them.

Remediation

References

https://github.com/dojo/dojox/security/advisories/GHSA-pg97-ww7h-5mjr

https://lists.debian.org/debian-lts-announce/2020/02/msg00033.html

https://snyk.io/vuln/SNYK-JS-DOJOX-548257%2C

Related Vulnerabilities

CVE-2018-1000615 Vulnerability in maven package org.onosproject:onos-ovsdb

CVE-2023-0410 Vulnerability in npm package @builder.io/qwik

CVE-2019-16728 Vulnerability in maven package org.webjars.bower:dompurify

CVE-2023-26107 Vulnerability in npm package sketchsvg

CVE-2023-5573 Vulnerability in npm package @vrite/sdk

Severity

High

Classification

CWE-79 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Tags

Exploit Third Party Advisory Mailing List