CVE-2020-5259: In affected versions of dojox (NPM package), the jqMix method is vulnerable to Prototype Pollution. Prototype Pollution refers to the ability to inject…

PriorityP346high8.6CVSS 3.1

AVNACLPRNUINSCCNIHAN

EPSS

1.98%

78.0th percentile

In affected versions of dojox (NPM package), the jqMix method is vulnerable to Prototype Pollution. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. This has been patched in versions 1.11.10, 1.12.8, 1.13.7, 1.14.6, 1.15.3 and 1.16.2

Affected

23 ranges

Vendor	Product	Version range	Fixed in
debian	dojo	< dojo 1.15.3+dfsg1-1 (bookworm)	dojo 1.15.3+dfsg1-1 (bookworm)
dojo	dojox	< 1.11.10	1.11.10
dojo	dojox	—	—
dojo	dojox	—	—
dojo	dojox	—	—
dojo	dojox	—	—
dojo	dojox	—	—
linuxfoundation	dojo	>= 0 < 1.15.3+dfsg1-1	1.15.3+dfsg1-1
linuxfoundation	dojo	>= 0 < 1.15.3+dfsg1-1	1.15.3+dfsg1-1
linuxfoundation	dojo	>= 0 < 1.15.3+dfsg1-1	1.15.3+dfsg1-1
linuxfoundation	dojo	>= 0 < 1.15.3+dfsg1-1	1.15.3+dfsg1-1
linuxfoundation	dojox	< 1.11.10	1.11.10
linuxfoundation	dojox	>= 0 < 1.11.10	1.11.10
linuxfoundation	dojox	>= 1.12.0 < 1.12.8	1.12.8
linuxfoundation	dojox	>= 1.12.0 < 1.12.8	1.12.8
linuxfoundation	dojox	>= 1.13.0 < 1.13.7	1.13.7
linuxfoundation	dojox	>= 1.13.0 < 1.13.7	1.13.7
linuxfoundation	dojox	>= 1.14.0 < 1.14.6	1.14.6
linuxfoundation	dojox	>= 1.14.0 < 1.14.6	1.14.6
linuxfoundation	dojox	>= 1.15.0 < 1.15.3	1.15.3
linuxfoundation	dojox	>= 1.15.0 < 1.15.3	1.15.3
linuxfoundation	dojox	>= 1.16.0 < 1.16.2	1.16.2
linuxfoundation	dojox	>= 1.16.0 < 1.16.2	1.16.2

CVSS provenance

nvdv3.18.6HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:P/A:N

osv8.6HIGH

vendor_debian7.7HIGH

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.