PT-2010-3862 · Dojo Foundation · Dojo

Publicado 2010-06-14 · Atualizado 2010-06-16 · CVE-2010-2276

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Dojo versions 0.4.x through 0.4.3 Dojo versions 1.0.x through 1.0.2 Dojo versions 1.1.x through 1.1.1 Dojo versions 1.2.x through 1.2.3 Dojo versions 1.3.x through 1.3.2 Dojo versions 1.4.x through 1.4.1

Description The default configuration of the build process in Dojo has the copyTests=true and mini=false options, which makes it easier for remote attackers to have an unspecified impact via a request to a test or demo component.

Recommendations For Dojo versions 0.4.x through 0.4.3, update to version 0.4.4 or later. For Dojo versions 1.0.x through 1.0.2, update to version 1.0.3 or later. For Dojo versions 1.1.x through 1.1.1, update to version 1.1.2 or later. For Dojo versions 1.2.x through 1.2.3, update to version 1.2.4 or later. For Dojo versions 1.3.x through 1.3.2, update to version 1.3.3 or later. For Dojo versions 1.4.x through 1.4.1, update to version 1.4.2 or later.

Correção

Enumeração de Fraquezas

CWE-16

Identificadores relacionados

CVE-2010-2276

Produtos afetados

Dojo

Referências · 14

• http://www-1.ibm.com/support/docview.wss?uid=swg1LO50994 · Aviso do Fabricante
• http://www-01.ibm.com/support/docview.wss?uid=swg21431472 · Nota
• http://www-1.ibm.com/support/docview.wss?uid=swg1LO50932 · Aviso do Fabricante
• http://www-1.ibm.com/support/docview.wss?uid=swg1LO50958 · Aviso do Fabricante
• http://www-1.ibm.com/support/docview.wss?uid=swg1LO50849 · Aviso do Fabricante
• http://www-1.ibm.com/support/docview.wss?uid=swg1LO50896 · Aviso do Fabricante
• http://www-1.ibm.com/support/docview.wss?uid=swg1LO50833 · Aviso do Fabricante
• http://secunia.com/advisories/38964 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2010-2276 · Nota de Segurança
• http://dojotoolkit.org/blog/post/dylan/2010/03/dojo-security-advisory · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2276 · Nota
• http://secunia.com/advisories/40007 · Aviso do Fabricante
• http://vupen.com/english/advisories/2010/1281 · Aviso do Fabricante
• http://www-1.ibm.com/support/docview.wss?uid=swg1LO50856 · Aviso do Fabricante