Description

dojox is vulnerable to Cross-site Scripting in all versions before version 1.16.1, 1.15.2, 1.14.5, 1.13.6, 1.12.7 and 1.11.9. This is due to dojox.xmpp.util.xmlEncode only encoding the first occurrence of each character, not all of them.

Remediation

References

https://github.com/dojo/dojox/security/advisories/GHSA-pg97-ww7h-5mjr

https://lists.debian.org/debian-lts-announce/2020/02/msg00033.html

https://snyk.io/vuln/SNYK-JS-DOJOX-548257%2C

Related Vulnerabilities

CVE-2021-21616 Vulnerability in maven package org.biouno:uno-choice

CVE-2020-9484 Vulnerability in maven package org.apache.tomcat:tomcat-catalina

CVE-2022-22969 Vulnerability in maven package org.springframework.security.oauth:spring-security-oauth2

CVE-2020-7679 Vulnerability in maven package org.webjars.bower:casperjs

CVE-2022-25898 Vulnerability in maven package org.webjars.bowergithub.kjur:jsrsasign

Severity

High

Classification

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Tags

Exploit Third Party Advisory Mailing List CWE-79