Cross-site Scripting Vulnerability in Dojo Package - CVE-2019-10785
Summary
CVE-2019-10785: dojox is vulnerable to Cross-site Scripting in all versions before version 1.16.1, 1.15.2, 1.14.5, 1.13.6, 1.12.7 and 1.11.9. Affects dojo across 2 version ranges.
< 1.15.2+dfsg1-1
>= 36af077105c8c07b98e331b3c0687a86eea1f717, < 21e2d558ed9b3b7e2907aaa0f815a9baf0b3f95c
Fixed in 1.15.2+dfsg1-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Dojo Toolkit is an open-source JavaScript framework designed for building web applications. It provides a rich set of features, including a modular architecture, robust widgets, and utilities for DOM manipulation, event handling, and AJAX. However, certain versions of the Dojo Toolkit, specifically the dojox module, are vulnerable to a Cross-site Scripting (XSS) attack due to improper encoding of XML data.
Vulnerability Detail
CVE-2019-10785 is a Cross-site Scripting vulnerability found in the dojox module of the Dojo Toolkit. The vulnerability arises from the function dojox.xmpp.util.xmlEncode, which only encodes the first occurrence of each character instead of all occurrences. This flaw allows attackers to inject malicious scripts into web applications that utilize the affected versions of the Dojo Toolkit, potentially compromising user data and leading to unauthorized actions within the application.
How To Fix
Minimum fixed version
1.15.2+dfsg1-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade dojoTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not feasible, consider implementing input validation and output encoding in your application to mitigate the risk of XSS attacks. Ensure that any user-generated content is properly sanitized before being rendered in the browser.
Conclusion
CVE-2019-10785 represents a significant security risk for applications using vulnerable versions of the Dojo Toolkit. It is crucial for developers to update to the patched versions to protect against potential XSS attacks. Additionally, utilizing tools like Vulert can help monitor and manage vulnerabilities in real-time.
See every vulnerability recorded for dojo →
FAQ
CVE-2019-10785 is a vulnerability in the Dojo Toolkit that allows for Cross-site Scripting attacks due to improper XML encoding.
All versions of Dojo Toolkit before 1.16.1, 1.15.2, 1.14.5, 1.13.6, 1.12.7, and 1.11.9 are affected by this vulnerability.
You can use Vulert, which monitors open-source vulnerabilities in your software using a manifest file like package-lock.json. Visit Vulert Scanner to check if your application is affected.
If exploited, this vulnerability can allow attackers to execute malicious scripts in the context of the user's browser, potentially leading to data theft or unauthorized actions.
The CVSS score for CVE-2019-10785 is 6.1, indicating a medium level of severity.
Related vulnerabilities
Recent vulnerabilities recorded for dojo.
