CVE-2018-1000665 — Cross-site Scripting in Dojo

CWE-79 — Cross-site Scripting10 documents7 sources
Severity
6.1MEDIUMNVD
EPSS
0.2%
top 64.28%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Linuxfoundation DojoDojotoolkit Dojo
Timeline
PublishedSep 6
Latest updateMay 14

Description

Dojo Dojo Objective Harness (DOH) version prior to version 1.14 contains a Cross Site Scripting (XSS) vulnerability in unit.html and testsDOH/_base/loader/i18n-exhaustive/i18n-test/unit.html and testsDOH/_base/i18nExhaustive.js in the DOH that can result in Victim attacked through their browser - deliver malware, steal HTTP cookies, bypass CORS trust. This attack appear to be exploitable via Victims are typically lured to a web site under the attacker's control; the XSS vulnerability on the targ…

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages2 packages

▶Debianlinuxfoundation/dojo< 1.14.1+dfsg1-1+3
▶NVDdojotoolkit/dojo1.13.0

Patches

Patch: dojotoolkit.org ↗Patch: dojotoolkit.org ↗

🔴Vulnerability Details

4
GHSA
Improper Neutralization of Input During Web Page Generation in Dojo Dojo Objective Harness↗2022-05-14
▶
OSV
Improper Neutralization of Input During Web Page Generation in Dojo Dojo Objective Harness↗2022-05-14
▶
CVEList
CVE-2018-1000665: Dojo Dojo Objective Harness (DOH) version prior to version 1↗2018-09-06
▶
OSV
CVE-2018-1000665: Dojo Dojo Objective Harness (DOH) version prior to version 1↗2018-09-06
▶

📋Vendor Advisories

2
Red Hat
dojo: Cross-site scripting in i18n-test/unit.html and _base/i18nExhaustive.js↗2018-09-06
▶
Debian
CVE-2018-1000665: dojo - Dojo Dojo Objective Harness (DOH) version prior to version 1.14 contains a Cross...↗2018
▶

💬Community

3
Bugzilla
CVE-2018-1000665 dojo: Cross-site scripting in i18n-test/unit.html and _base/i18nExhaustive.js↗2018-09-06
▶
Bugzilla
CVE-2018-1000665 dojo: Cross-site scripting in i18n-test/unit.html and _base/i18nExhaustive.js [fedora-all]↗2018-09-06
▶
Bugzilla
CVE-2018-1000665 dojo: Cross-site scripting in i18n-test/unit.html and _base/i18nExhaustive.js [epel-all]↗2018-09-06
▶
CVE-2018-1000665 — Cross-site Scripting in Dojo | cvebase