PT-2015-7017 · Dojo Foundation · Dojo Toolkit

Daiki Fukumori

·

CVE-2015-5654

·

Published

2015-10-11

·

Updated

2020-09-11

CVSS v3.1

5.4

Medium

VectorAV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions Dojo Toolkit versions prior to 1.2.0
Description A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML. The package fails to sanitize HTML code in user-controlled input, allowing attackers to execute arbitrary JavaScript in the victim's browser.
Recommendations Upgrade to version 1.2.0 or later.

Fix

XSS

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2015-5654
GHSA-P82G-2XPP-M5R3

Affected Products

Dojo Toolkit