CVE-2019-10785 Information

Description

dojox is vulnerable to Cross-site Scripting in all versions before version 1.16.1 1.15.2 1.14.5 1.13.6 1.12.7 and 1.11.9. This is due to dojox.xmpp.util.xmlEncode only encoding the first occurrence of each character not all of them.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Reference

https://github.com/dojo/dojox/security/advisories/GHSA-pg97-ww7h-5mjr https://lists.debian.org/debian-lts-announce/2020/02/msg00033.html https://snyk.io/vuln/SNYK-JS-DOJOX-548257

Attack Complexity

LOW

Privileges Required

NONE

User Interaction Required

NONE

Scope

REQUIRED

Confidentiality Impact

CHANGED

Integrity Impact

LOW

Availability Impact

LOW

Base Score

NONE

Base Severity

6.1