En resumen
- CVE-2020-4051 es una vulnerabilidad MEDIO (CVSS 5.4) que afecta a dijit (openjsf), dijit.
- Probabilidad de explotación en los próximos 30 días (EPSS): 1.2%, mayor que el 67.7% de las vulnerabilidades.
- Solución: actualizar a 1.12.9, 1.13.8, 1.14.7, 1.15.4 o posterior.
| Package | Affected versions | Patched versions |
|---|
| dijit | ≥ 1.12.0, < 1.12.9≥ 1.13.0, < 1.13.8≥ 1.14.0, < 1.14.7≥ 1.15.0, < 1.15.4≥ 1.16.0, < 1.16.3< 1.11.11
| 1.12.91.13.81.14.71.15.41.16.31.11.11
|
| dijit npm | ≥ 1.12.0, < 1.12.9≥ 1.13.0, < 1.13.8≥ 1.14.0, < 1.14.7≥ 1.15.0, < 1.15.4≥ 1.16.0, < 1.16.3< 1.11.11
| 1.12.91.13.81.14.71.15.41.16.31.11.11
|
Description
Impact
XSS possible for users of the Dijit Editor's LinkDialog plugin
Patches
Yes, 1.11.11, 1.12.9, 1.13.8, 1.14.7, 1.15.4, 1.16.3
Workarounds
Users may apply the patch made in these releases.
For more information
If you have any questions or comments about this advisory, open an issue in dojo/dijit
NVD description
In Dijit before versions 1.11.11, and greater than or equal to 1.12.0 and less than 1.12.9, and greater than or equal to 1.13.0 and less than 1.13.8, and greater than or equal to 1.14.0 and less than 1.14.7, and greater than or equal to 1.15.0 and less than 1.15.4, and greater than or equal to 1.16.0 and less than 1.16.3, there is a cross-site scripting vulnerability in the Editor's LinkDialog plugin. This has been fixed in 1.11.11, 1.12.9, 1.13.8, 1.14.7, 1.15.4, 1.16.3.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free