Description

In Dojo Toolkit before 1.14, there is unescaped string injection in dojox/Grid/DataGrid.

Remediation

References

https://dojotoolkit.org/blog/dojo-1-14-released

https://github.com/dojo/dojox/pull/283

https://lists.debian.org/debian-lts-announce/2018/09/msg00002.html

Related Vulnerabilities

CVE-2017-2654 Vulnerability in maven package org.jenkins-ci.plugins:email-ext

CVE-2023-20873 Vulnerability in maven package org.springframework.boot:spring-boot-actuator-autoconfigure

CVE-2018-1000665 Vulnerability in npm package dojo

CVE-2022-22980 Vulnerability in maven package org.springframework.data:spring-data-mongodb

CVE-2023-25157 Vulnerability in maven package org.geoserver.community:gs-jdbcconfig

Severity

Critical

Classification

CWE-116 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Vendor Advisory Third Party Advisory