CVE-2010-2273

Description

Versions of `dojo` prior to 1.4.2 are vulnerable to DOM-based Cross-Site Scripting (XSS). The package does not sanitize URL parameters in the `_testCommon.js` and `runner.html` test files, allowing attackers to execute arbitrary JavaScript in the victim's browser. ## Recommendation Upgrade to version 1.4.2 or later.

Affected packages (2)

• Debian/dojofrom 0, < 1.4.2+dfsg-1
• npm/dojo>= 1.13.0, < 1.13.1

References (20)

• ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2010-2273
• ADVISORYhttps://security-tracker.debian.org/tracker/CVE-2010-2273
• WEBhttp://bugs.dojotoolkit.org/ticket/10773
• WEBhttp://dojotoolkit.org/blog/post/dylan/2010/03/dojo-security-advisory
• WEBhttps://bugs.dojotoolkit.org/ticket/10773
• WEBhttp://secunia.com/advisories/38964
• WEBhttp://secunia.com/advisories/40007
• WEBhttps://github.com/dojo/dojo/commit/9117ffd5a3863e44c92fcd58564c0da22be858f4
• WEBhttps://github.com/dojo/dojo/pull/307
• WEBhttps://www.npmjs.com/advisories/972
• WEBhttp://www-01.ibm.com/support/docview.wss?uid=swg21431472
• WEBhttp://www-1.ibm.com/support/docview.wss?uid=swg1LO50833
• WEBhttp://www-1.ibm.com/support/docview.wss?uid=swg1LO50849
• WEBhttp://www-1.ibm.com/support/docview.wss?uid=swg1LO50856
• WEBhttp://www-1.ibm.com/support/docview.wss?uid=swg1LO50896
• WEBhttp://www-1.ibm.com/support/docview.wss?uid=swg1LO50932
• WEBhttp://www-1.ibm.com/support/docview.wss?uid=swg1LO50958
• WEBhttp://www-1.ibm.com/support/docview.wss?uid=swg1LO50994
• WEBhttp://www.gdssecurity.com/l/b/2010/03/12/multiple-dom-based-xss-in-dojo-toolkit-sdk
• WEBhttp://www.vupen.com/english/advisories/2010/1281