Kurz gesagt
- CVE-2020-4051 ist eine Schwachstelle (MITTEL (CVSS 5.4)) in dijit (openjsf), dijit.
- Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 1.2%, höher als bei 67.7% aller Schwachstellen.
- Abhilfe: auf 1.12.9, 1.13.8, 1.14.7, 1.15.4 oder neuer aktualisieren.
| Package | Affected versions | Patched versions |
|---|
| dijit | ≥ 1.12.0, < 1.12.9≥ 1.13.0, < 1.13.8≥ 1.14.0, < 1.14.7≥ 1.15.0, < 1.15.4≥ 1.16.0, < 1.16.3< 1.11.11
| 1.12.91.13.81.14.71.15.41.16.31.11.11
|
| dijit npm | ≥ 1.12.0, < 1.12.9≥ 1.13.0, < 1.13.8≥ 1.14.0, < 1.14.7≥ 1.15.0, < 1.15.4≥ 1.16.0, < 1.16.3< 1.11.11
| 1.12.91.13.81.14.71.15.41.16.31.11.11
|
Description
Impact
XSS possible for users of the Dijit Editor's LinkDialog plugin
Patches
Yes, 1.11.11, 1.12.9, 1.13.8, 1.14.7, 1.15.4, 1.16.3
Workarounds
Users may apply the patch made in these releases.
For more information
If you have any questions or comments about this advisory, open an issue in dojo/dijit
NVD description
In Dijit before versions 1.11.11, and greater than or equal to 1.12.0 and less than 1.12.9, and greater than or equal to 1.13.0 and less than 1.13.8, and greater than or equal to 1.14.0 and less than 1.14.7, and greater than or equal to 1.15.0 and less than 1.15.4, and greater than or equal to 1.16.0 and less than 1.16.3, there is a cross-site scripting vulnerability in the Editor's LinkDialog plugin. This has been fixed in 1.11.11, 1.12.9, 1.13.8, 1.14.7, 1.15.4, 1.16.3.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free