Cross-Site Scripting in dojo
Affected versions of `dojo` are susceptible to a cross-site scripting vulnerability in the `dijit.Editor` and `textarea` components, which execute their contents as Javascript, even when sanitized. ## Recommendation Update to version 1.1.0 or later.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2008-6681US | medium4.3 | — | ||
Cross-site scripting (XSS) vulnerability in dijit.Editor in Dojo before 1.1 allows remote attackers to inject arbitrary web script or HTML via XML entities in a TEXTAREA element. | ||||
02
references
External citations — patches, advisories, analysis.
- http://trac.dojotoolkit.org/changeset/15346WEB
- http://trac.dojotoolkit.org/ticket/2140WEB
- http://www.dojotoolkit.org/book/dojo-1-1-release-notesWEB
- http://www.securityfocus.com/bid/34661WEB
- https://bugs.dojotoolkit.org/ticket/2140WEB
- https://exchange.xforce.ibmcloud.com/vulnerabilities/49883WEB
- https://nvd.nist.gov/vuln/detail/CVE-2008-6681ADVISORY
- https://www.npmjs.com/advisories/107WEB
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan