CVE-2020-4051: Cross-site Scripting in dijit editor's LinkDialog plugin
Summary
CVE-2020-4051: Cross-site Scripting in dijit editor's LinkDialog plugin. Affects dijit across 6 version ranges.
< 1.11.11
>= 1.12.0, < 1.12.9
>= 1.13.0, < 1.13.8
>= 1.14.0, < 1.14.7
>= 1.15.0, < 1.15.4
>= 1.16.0, < 1.16.3
Fixed in 6 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- dojo · Debian:11
The same CVE-2020-4051 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The dijit package is an open-source JavaScript library that provides a set of user interface widgets for building web applications. It includes the Dijit Editor, which is a rich text editor that allows users to create and edit content. The LinkDialog plugin is a component of the Dijit Editor that provides functionality for inserting and editing hyperlinks in the editor's content.
Vulnerability Detail
This vulnerability allows for cross-site scripting (XSS) attacks in the Dijit Editor's LinkDialog plugin. An attacker can exploit this vulnerability by injecting malicious code into the hyperlink URL or label fields in the LinkDialog. When a user interacts with the hyperlink, the injected code will be executed in the user's browser, potentially leading to unauthorized actions or data theft. The vulnerability has a CVSS score of 3.7, indicating a low severity level.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.11.111.11.11npm install dijit@1.11.11 -
>= 1.12.0, < 1.12.91.12.9npm install dijit@1.12.9 -
>= 1.13.0, < 1.13.81.13.8npm install dijit@1.13.8 -
>= 1.14.0, < 1.14.71.14.7npm install dijit@1.14.7 -
>= 1.15.0, < 1.15.41.15.4npm install dijit@1.15.4 -
>= 1.16.0, < 1.16.31.16.3npm install dijit@1.16.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If users are unable to immediately update their dijit package, they can apply a temporary workaround by disabling the LinkDialog plugin in the Dijit Editor. This can be done by modifying the configuration of the editor to exclude the LinkDialog plugin. Here is an example of how to disable the plugin in a JavaScript file:
require(['dijit/Editor'], function(Editor) {
var editor = new Editor({
plugins: {
linkDialog: false
}
});
});
Conclusion
The dijit package's LinkDialog plugin is vulnerable to cross-site scripting attacks. Users should update their dijit package to one of the patched versions or apply the workaround of disabling the LinkDialog plugin. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for dijit →
FAQ
The vulnerability allows for cross-site scripting attacks, which can lead to unauthorized actions or data theft in the user's browser.
Versions 0.0.0 through 1.11.10 are affected by this vulnerability.
There are no known exploits of this vulnerability at this time.
Yes, users can update their dijit package to one of the patched versions: 1.11.11, 1.12.9, 1.13.8, 1.14.7, 1.15.4, or 1.16.3.
Yes, users can disable the LinkDialog plugin in the Dijit Editor as a temporary workaround until they can update their dijit package.
References
Related vulnerabilities
Recent vulnerabilities recorded for dijit.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
