CVE-2019-10785: XSS Vulnerability in dojox.xmpp.util.xmlEncode
Summary
CVE-2019-10785: XSS in dojox due to insufficient escape in dojox.xmpp.util.xmlEncode. Affects dojox across 6 version ranges.
< 1.11.9
>= 1.12.0, < 1.12.7
>= 1.13.0, < 1.13.6
>= 1.14.0, < 1.14.5
>= 1.15.0, < 1.15.2
>= 1.16.0, < 1.16.1
Fixed in 6 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- dojo · Debian:11
The same CVE-2019-10785 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package under scrutiny is dojox, an open-source JavaScript toolkit that provides various utilities and widgets for web development. It includes modules like dojox.xmpp and dojox.dtl. The dojox.xmpp.util.xmlEncode module is responsible for encoding XML data. However, it has been found that this module lacks sufficient escape mechanisms, potentially leading to cross-site scripting (XSS) vulnerabilities.
Vulnerability Detail
The vulnerability in dojox.xmpp.util.xmlEncode arises from insufficient escape mechanisms, which can allow malicious actors to inject arbitrary scripts into web pages that utilize the affected module. This can lead to the execution of unauthorized code in the context of unsuspecting users, potentially compromising their sensitive information or performing unauthorized actions on their behalf. The vulnerability has a CVSS score of 6.1, indicating a moderate severity level.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.11.91.11.9npm install dojox@1.11.9 -
>= 1.12.0, < 1.12.71.12.7npm install dojox@1.12.7 -
>= 1.13.0, < 1.13.61.13.6npm install dojox@1.13.6 -
>= 1.14.0, < 1.14.51.14.5npm install dojox@1.14.5 -
>= 1.15.0, < 1.15.21.15.2npm install dojox@1.15.2 -
>= 1.16.0, < 1.16.11.16.1npm install dojox@1.16.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
A separate patch can be applied by incorporating the change provided in the following pull request: https://github.com/dojo/dojox/pull/315. This patch can be manually added to the affected version of Dojo as an alternative to upgrading.
Conclusion
In conclusion, the dojox.xmpp.util.xmlEncode module in Dojo is vulnerable to cross-site scripting (XSS) attacks due to insufficient escape mechanisms. Users should upgrade to the patched versions or apply the provided patch to mitigate the risk. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for dojox →
FAQ
The vulnerability can potentially lead to cross-site scripting (XSS) attacks, allowing malicious actors to execute unauthorized code in the context of unsuspecting users.
The vulnerability affects Dojo versions 1.11 through 1.16. Users of Dojo 1.10.x and earlier should also review the provided change and determine if it applies to their version.
Yes, a separate patch can be applied by incorporating the change provided in the pull request mentioned earlier.
The vulnerability has a CVSS score of 6.1, indicating a moderate severity level.
For more information, you can open an issue in the https://github.com/dojo/dojox repository.
References
Related vulnerabilities
Recent vulnerabilities recorded for dojox.
