CVE-2010-2273
published 2010-06-15CVE-2010-2273: Multiple cross-site scripting (XSS) vulnerabilities in Dojo 1.0.x before 1.0.3, 1.1.x before 1.1.2, 1.2.x before 1.2.4, 1.3.x before 1.3.3, and 1.4.x before…
PriorityP422medium4.3CVSS 2.0
AVNACMAuNCNIPAN
EXPLOIT
EPSS
4.54%
90.4th percentile
Multiple cross-site scripting (XSS) vulnerabilities in Dojo 1.0.x before 1.0.3, 1.1.x before 1.1.2, 1.2.x before 1.2.4, 1.3.x before 1.3.3, and 1.4.x before 1.4.2 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, possibly related to dojo/resources/iframe_history.html, dojox/av/FLAudio.js, dojox/av/FLVideo.js, dojox/av/resources/audio.swf, dojox/av/resources/video.swf, util/buildscripts/jslib/build.js, and util/buildscripts/jslib/buildUtil.js, as demonstrated by the (1) dojoUrl and (2) testUrl parameters to util/doh/runner.html.
Affected
23 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | dojo | < dojo 1.4.2+dfsg-1 (bookworm) | dojo 1.4.2+dfsg-1 (bookworm) |
| dojotoolkit | dojo | — | — |
| dojotoolkit | dojo | — | — |
| dojotoolkit | dojo | — | — |
| dojotoolkit | dojo | — | — |
| dojotoolkit | dojo | — | — |
| dojotoolkit | dojo | — | — |
| dojotoolkit | dojo | — | — |
| dojotoolkit | dojo | — | — |
| dojotoolkit | dojo | — | — |
| dojotoolkit | dojo | — | — |
| dojotoolkit | dojo | — | — |
| dojotoolkit | dojo | — | — |
| dojotoolkit | dojo | — | — |
| dojotoolkit | dojo | — | — |
| linuxfoundation | dojo | >= 0 < 1.4.2+dfsg-1 | 1.4.2+dfsg-1 |
| linuxfoundation | dojo | >= 0 < 1.4.2+dfsg-1 | 1.4.2+dfsg-1 |
| linuxfoundation | dojo | >= 0 < 1.4.2+dfsg-1 | 1.4.2+dfsg-1 |
| linuxfoundation | dojo | >= 0 < 1.4.2+dfsg-1 | 1.4.2+dfsg-1 |
| linuxfoundation | dojo | >= 1.10.0 < 1.10.10 | 1.10.10 |
| linuxfoundation | dojo | >= 1.11.0 < 1.11.6 | 1.11.6 |
| linuxfoundation | dojo | >= 1.12.0 < 1.12.4 | 1.12.4 |
| linuxfoundation | dojo | >= 1.13.0 < 1.13.1 | 1.13.1 |
CVSS provenance
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
osv4.3MEDIUM
vendor_debian4.3MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Cross-Site Scripting in dojo
osv·2019-09-11
CVE-2010-2273 [MEDIUM] Cross-Site Scripting in dojo
Cross-Site Scripting in dojo
Versions of `dojo` prior to 1.4.2 are vulnerable to DOM-based Cross-Site Scripting (XSS). The package does not sanitize URL parameters in the `_testCommon.js` and `runner.html` test files, allowing attackers to execute arbitrary JavaScript in the victim's browser.
## Recommendation
Upgrade to version 1.4.2 or later.
GHSA
Cross-Site Scripting in dojo
ghsa·2019-09-11
CVE-2010-2273 [MEDIUM] CWE-79 Cross-Site Scripting in dojo
Cross-Site Scripting in dojo
Versions of `dojo` prior to 1.4.2 are vulnerable to DOM-based Cross-Site Scripting (XSS). The package does not sanitize URL parameters in the `_testCommon.js` and `runner.html` test files, allowing attackers to execute arbitrary JavaScript in the victim's browser.
## Recommendation
Upgrade to version 1.4.2 or later.
OSV
CVE-2010-2273: Multiple cross-site scripting (XSS) vulnerabilities in Dojo 1
osv·2010-06-15·CVSS 4.3
CVE-2010-2273 [MEDIUM] CVE-2010-2273: Multiple cross-site scripting (XSS) vulnerabilities in Dojo 1
Multiple cross-site scripting (XSS) vulnerabilities in Dojo 1.0.x before 1.0.3, 1.1.x before 1.1.2, 1.2.x before 1.2.4, 1.3.x before 1.3.3, and 1.4.x before 1.4.2 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, possibly related to dojo/resources/iframe_history.html, dojox/av/FLAudio.js, dojox/av/FLVideo.js, dojox/av/resources/audio.swf, dojox/av/resources/video.swf, util/buildscripts/jslib/build.js, and util/buildscripts/jslib/buildUtil.js, as demonstrated by the (1) dojoUrl and (2) testUrl parameters to util/doh/runner.html.
Debian
CVE-2010-2273: dojo - Multiple cross-site scripting (XSS) vulnerabilities in Dojo 1.0.x before 1.0.3, ...
vendor_debian·2010·CVSS 4.3
CVE-2010-2273 [MEDIUM] CVE-2010-2273: dojo - Multiple cross-site scripting (XSS) vulnerabilities in Dojo 1.0.x before 1.0.3, ...
Multiple cross-site scripting (XSS) vulnerabilities in Dojo 1.0.x before 1.0.3, 1.1.x before 1.1.2, 1.2.x before 1.2.4, 1.3.x before 1.3.3, and 1.4.x before 1.4.2 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, possibly related to dojo/resources/iframe_history.html, dojox/av/FLAudio.js, dojox/av/FLVideo.js, dojox/av/resources/audio.swf, dojox/av/resources/video.swf, util/buildscripts/jslib/build.js, and util/buildscripts/jslib/buildUtil.js, as demonstrated by the (1) dojoUrl and (2) testUrl parameters to util/doh/runner.html.
Scope: local
bookworm: resolved (fixed in 1.4.2+dfsg-1)
bullseye: resolved (fixed in 1.4.2+dfsg-1)
forky: resolved (fixed in 1.4.2+dfsg-1)
sid: resolved (fixed in 1.4.2+dfsg-1)
trixie: resolved (fixed in 1.4.2+dfsg-1)
No detection rules found.
No writeups or analysis indexed.
http://bugs.dojotoolkit.org/ticket/10773http://dojotoolkit.org/blog/post/dylan/2010/03/dojo-security-advisory/http://secunia.com/advisories/38964http://secunia.com/advisories/40007http://www-01.ibm.com/support/docview.wss?uid=swg21431472http://www-1.ibm.com/support/docview.wss?uid=swg1LO50833http://www-1.ibm.com/support/docview.wss?uid=swg1LO50849http://www-1.ibm.com/support/docview.wss?uid=swg1LO50856http://www-1.ibm.com/support/docview.wss?uid=swg1LO50896http://www-1.ibm.com/support/docview.wss?uid=swg1LO50932http://www-1.ibm.com/support/docview.wss?uid=swg1LO50958http://www-1.ibm.com/support/docview.wss?uid=swg1LO50994http://www.gdssecurity.com/l/b/2010/03/12/multiple-dom-based-xss-in-dojo-toolkit-sdk/http://www.vupen.com/english/advisories/2010/1281http://bugs.dojotoolkit.org/ticket/10773http://dojotoolkit.org/blog/post/dylan/2010/03/dojo-security-advisory/http://secunia.com/advisories/38964http://secunia.com/advisories/40007http://www-01.ibm.com/support/docview.wss?uid=swg21431472http://www-1.ibm.com/support/docview.wss?uid=swg1LO50833http://www-1.ibm.com/support/docview.wss?uid=swg1LO50849http://www-1.ibm.com/support/docview.wss?uid=swg1LO50856http://www-1.ibm.com/support/docview.wss?uid=swg1LO50896http://www-1.ibm.com/support/docview.wss?uid=swg1LO50932http://www-1.ibm.com/support/docview.wss?uid=swg1LO50958http://www-1.ibm.com/support/docview.wss?uid=swg1LO50994http://www.gdssecurity.com/l/b/2010/03/12/multiple-dom-based-xss-in-dojo-toolkit-sdk/http://www.vupen.com/english/advisories/2010/1281
2010-06-15
Published