Description

dojox is vulnerable to Cross-site Scripting in all versions before version 1.16.1, 1.15.2, 1.14.5, 1.13.6, 1.12.7 and 1.11.9. This is due to dojox.xmpp.util.xmlEncode only encoding the first occurrence of each character, not all of them.

Remediation

References

https://github.com/dojo/dojox/security/advisories/GHSA-pg97-ww7h-5mjr

https://lists.debian.org/debian-lts-announce/2020/02/msg00033.html

https://snyk.io/vuln/SNYK-JS-DOJOX-548257%2C

Related Vulnerabilities

CVE-2020-15252 Vulnerability in maven package org.xwiki.platform:xwiki-platform-oldcore

CVE-2020-28469 Vulnerability in maven package org.webjars.bowergithub.es128:glob-parent

CVE-2023-0842 Vulnerability in maven package org.webjars.npm:xml2js

CVE-2021-32796 Vulnerability in npm package xmldom

CVE-2019-18798 Vulnerability in npm package node-sass

Severity

High

Classification

CWE-79 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Tags

Exploit Third Party Advisory Mailing List