CVE-2010-2273

Multiple cross-site scripting (XSS) vulnerabilities in Dojo 1.0.x before 1.0.3, 1.1.x before 1.1.2, 1.2.x before 1.2.4, 1.3.x before 1.3.3, and 1.4.x before 1.4.2 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, possibly related to dojo/resources/iframe_history.html, dojox/av/FLAudio.js, dojox/av/FLVideo.js, dojox/av/resources/audio.swf, dojox/av/resources/video.swf, util/buildscripts/jslib/build.js, and util/buildscripts/jslib/buildUtil.js, as demonstrated by the (1) dojoUrl and (2) testUrl parameters to util/doh/runner.html.
References
Link Resource
http://bugs.dojotoolkit.org/ticket/10773 Exploit
http://dojotoolkit.org/blog/post/dylan/2010/03/dojo-security-advisory/ Patch Vendor Advisory
http://secunia.com/advisories/38964 Vendor Advisory
http://secunia.com/advisories/40007 Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21431472
http://www-1.ibm.com/support/docview.wss?uid=swg1LO50833
http://www-1.ibm.com/support/docview.wss?uid=swg1LO50849
http://www-1.ibm.com/support/docview.wss?uid=swg1LO50856
http://www-1.ibm.com/support/docview.wss?uid=swg1LO50896
http://www-1.ibm.com/support/docview.wss?uid=swg1LO50932
http://www-1.ibm.com/support/docview.wss?uid=swg1LO50958
http://www-1.ibm.com/support/docview.wss?uid=swg1LO50994
http://www.gdssecurity.com/l/b/2010/03/12/multiple-dom-based-xss-in-dojo-toolkit-sdk/ Exploit
http://www.vupen.com/english/advisories/2010/1281 Vendor Advisory
http://bugs.dojotoolkit.org/ticket/10773 Exploit
http://dojotoolkit.org/blog/post/dylan/2010/03/dojo-security-advisory/ Patch Vendor Advisory
http://secunia.com/advisories/38964 Vendor Advisory
http://secunia.com/advisories/40007 Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21431472
http://www-1.ibm.com/support/docview.wss?uid=swg1LO50833
http://www-1.ibm.com/support/docview.wss?uid=swg1LO50849
http://www-1.ibm.com/support/docview.wss?uid=swg1LO50856
http://www-1.ibm.com/support/docview.wss?uid=swg1LO50896
http://www-1.ibm.com/support/docview.wss?uid=swg1LO50932
http://www-1.ibm.com/support/docview.wss?uid=swg1LO50958
http://www-1.ibm.com/support/docview.wss?uid=swg1LO50994
http://www.gdssecurity.com/l/b/2010/03/12/multiple-dom-based-xss-in-dojo-toolkit-sdk/ Exploit
http://www.vupen.com/english/advisories/2010/1281 Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:dojotoolkit:dojo:1.0:*:*:*:*:*:*:*
cpe:2.3:a:dojotoolkit:dojo:1.0.1:*:*:*:*:*:*:*
cpe:2.3:a:dojotoolkit:dojo:1.0.2:*:*:*:*:*:*:*
cpe:2.3:a:dojotoolkit:dojo:1.1:*:*:*:*:*:*:*
cpe:2.3:a:dojotoolkit:dojo:1.1.1:*:*:*:*:*:*:*
cpe:2.3:a:dojotoolkit:dojo:1.2:*:*:*:*:*:*:*
cpe:2.3:a:dojotoolkit:dojo:1.2.1:*:*:*:*:*:*:*
cpe:2.3:a:dojotoolkit:dojo:1.2.2:*:*:*:*:*:*:*
cpe:2.3:a:dojotoolkit:dojo:1.2.3:*:*:*:*:*:*:*
cpe:2.3:a:dojotoolkit:dojo:1.3:*:*:*:*:*:*:*
cpe:2.3:a:dojotoolkit:dojo:1.3.1:*:*:*:*:*:*:*
cpe:2.3:a:dojotoolkit:dojo:1.3.2:*:*:*:*:*:*:*
cpe:2.3:a:dojotoolkit:dojo:1.4:*:*:*:*:*:*:*
cpe:2.3:a:dojotoolkit:dojo:1.4.1:*:*:*:*:*:*:*

History

21 Nov 2024, 01:16

Type Values Removed Values Added
References () http://bugs.dojotoolkit.org/ticket/10773 - Exploit () http://bugs.dojotoolkit.org/ticket/10773 - Exploit
References () http://dojotoolkit.org/blog/post/dylan/2010/03/dojo-security-advisory/ - Patch, Vendor Advisory () http://dojotoolkit.org/blog/post/dylan/2010/03/dojo-security-advisory/ - Patch, Vendor Advisory
References () http://secunia.com/advisories/38964 - Vendor Advisory () http://secunia.com/advisories/38964 - Vendor Advisory
References () http://secunia.com/advisories/40007 - Vendor Advisory () http://secunia.com/advisories/40007 - Vendor Advisory
References () http://www-01.ibm.com/support/docview.wss?uid=swg21431472 - () http://www-01.ibm.com/support/docview.wss?uid=swg21431472 -
References () http://www-1.ibm.com/support/docview.wss?uid=swg1LO50833 - () http://www-1.ibm.com/support/docview.wss?uid=swg1LO50833 -
References () http://www-1.ibm.com/support/docview.wss?uid=swg1LO50849 - () http://www-1.ibm.com/support/docview.wss?uid=swg1LO50849 -
References () http://www-1.ibm.com/support/docview.wss?uid=swg1LO50856 - () http://www-1.ibm.com/support/docview.wss?uid=swg1LO50856 -
References () http://www-1.ibm.com/support/docview.wss?uid=swg1LO50896 - () http://www-1.ibm.com/support/docview.wss?uid=swg1LO50896 -
References () http://www-1.ibm.com/support/docview.wss?uid=swg1LO50932 - () http://www-1.ibm.com/support/docview.wss?uid=swg1LO50932 -
References () http://www-1.ibm.com/support/docview.wss?uid=swg1LO50958 - () http://www-1.ibm.com/support/docview.wss?uid=swg1LO50958 -
References () http://www-1.ibm.com/support/docview.wss?uid=swg1LO50994 - () http://www-1.ibm.com/support/docview.wss?uid=swg1LO50994 -
References () http://www.gdssecurity.com/l/b/2010/03/12/multiple-dom-based-xss-in-dojo-toolkit-sdk/ - Exploit () http://www.gdssecurity.com/l/b/2010/03/12/multiple-dom-based-xss-in-dojo-toolkit-sdk/ - Exploit
References () http://www.vupen.com/english/advisories/2010/1281 - Vendor Advisory () http://www.vupen.com/english/advisories/2010/1281 - Vendor Advisory

Information

Published : 2010-06-15 14:30

Updated : 2024-11-21 01:16


NVD link : CVE-2010-2273

Mitre link : CVE-2010-2273

CVE.ORG link : CVE-2010-2273


JSON object : View

Products Affected

dojotoolkit

  • dojo
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')