PT-2018-2291 · Dojo Foundation · Dojo Toolkit

Imsebao · Publicado 2018-02-02 · Atualizado 2022-05-14 · CVE-2018-6561

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Dojo Toolkit version 1.13

Description The issue is related to the dijit.Editor component in Dojo Toolkit, which allows for cross-site scripting (XSS) attacks via the onload attribute of an SVG element. This can enable a remote attacker to perform cross-site scripting attacks.

Recommendations For Dojo Toolkit version 1.13, consider disabling the use of SVG elements with the onload attribute in the dijit.Editor component until a patch is available. Restrict access to the dijit.Editor component to minimize the risk of exploitation. Avoid using the onload attribute in SVG elements within the dijit.Editor component until the issue is resolved.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

BDU:2019-00417

CVE-2018-6561

GHSA-WP32-WQ34-2RQH

Produtos afetados

Dojo Toolkit

Referências · 13

• 🔥 https://github.com/imsebao/404team/blob/master/dijit_editor_xss.md · Exploit
• https://github.com/dojo/dijit · Nota
• https://github.com/dojo/dijit/commit/d22d6cc3458c3c29d2d1fc44652b4bd7f10751f6 · Nota
• https://osv.dev/vulnerability/GHSA-wp32-wq34-2rqh · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2019-00417 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2018-6561 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-6561 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2018-6561 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2018-6561 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2018-6561 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-6561 · Nota
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-6561 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-6561 · Aviso do Fabricante