Unscored severity · published Jun 15, 2010
CVE-2010-2273
Multiple cross-site scripting (XSS) vulnerabilities in Dojo 1.0.x before 1.0.3, 1.1.x before 1.1.2, 1.2.x before 1.2.4, 1.3.x before 1.3.3, and 1.4.x before 1.4.2 allow remote…
–
CVSS
4.5%
EPSS
No
On KEV
Description
Multiple cross-site scripting (XSS) vulnerabilities in Dojo 1.0.x before 1.0.3, 1.1.x before 1.1.2, 1.2.x before 1.2.4, 1.3.x before 1.3.3, and 1.4.x before 1.4.2 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, possibly related to dojo/resources/iframe_history.html, dojox/av/FLAudio.js, dojox/av/FLVideo.js, dojox/av/resources/audio.swf, dojox/av/resources/video.swf, util/buildscripts/jslib/build.js, and util/buildscripts/jslib/buildUtil.js, as demonstrated by the (1) dojoUrl and (2) testUrl parameters to util/doh/runner.html.
Exploitation
Is it being used?
Exploit prediction (EPSS)4.5% · higher than 92% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DO
Dojo · Dojotoolkit
1.0; 1.0.1; 1.0.2; 1.1; 1.1.1; 1.2; +8 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2010-2273
CVE.org
https://www.cve.org/CVERecord?id=CVE-2010-2273
Exploit
http://bugs.dojotoolkit.org/ticket/10773
Patch
http://dojotoolkit.org/blog/post/dylan/2010/03/dojo-security-advisory/
Vendor Advisory
http://secunia.com/advisories/38964
Vendor Advisory
http://secunia.com/advisories/40007
www-01.ibm.com
http://www-01.ibm.com/support/docview.wss?uid=swg21431472
www-1.ibm.com
http://www-1.ibm.com/support/docview.wss?uid=swg1LO50833
More from Dojo
9.8
CVE-2018-15494
In Dojo Toolkit before 1.14, there is unescaped string injection in dojox/Grid/DataGrid
6.1
CVE-2018-1000665
Dojo Dojo Objective Harness (DOH) version prior to version 1.14 contains a Cross Site Scripting (XSS) vulnerability in unit.html and…
6.1
CVE-2018-6561
dijit.Editor in Dojo Toolkit 1.13 allows XSS via the onload attribute of an SVG element
–
CVE-2015-5654
Cross-site scripting (XSS) vulnerability in Dojo Toolkit before 1.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors
–
CVE-2010-2276
The default configuration of the build process in Dojo 0.4.x before 0.4.4, 1.0.x before 1.0.3, 1.1.x before 1.1.2, 1.2.x before 1.2.4, 1.3.x before 1.3.3, and 1.4.x before 1.4.2…