PT-2018-3673 · Dojo+2 · Dojo Toolkit+2

Moritz Bechler · Publicado 2018-07-12 · Atualizado 2025-06-16 · CVE-2018-15494

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Dojo Toolkit versions prior to 1.14

Description The issue is related to unescaped string injection in dojox/Grid/DataGrid, which can be exploited by a remote attacker to impact the confidentiality, integrity, and availability of protected information. This is due to incorrect encoding or hiding of output data.

Recommendations For versions prior to 1.14, update to version 1.14 or later to resolve the issue. As a temporary workaround, consider restricting access to the dojox/Grid/DataGrid component until a patch is available.

Correção

Improper Encoding or Escaping of Output

Enumeração de Fraquezas

CWE-116

Identificadores relacionados

BDU:2021-02951

CVE-2018-15494

DLA-1492-1

GHSA-84CM-X2Q5-8225

USN-7569-1

Produtos afetados

Dojo Toolkit

Linuxmint

Ubuntu

Referências · 25

• https://github.com/dojo/dojox · Nota
• https://github.com/dojo/dojox/pull/283 · Nota
• https://dojotoolkit.org/blog/dojo-1-14-released · Aviso do Fabricante
• https://osv.dev/vulnerability/DLA-1492-1 · Aviso do Fabricante
• https://safe-surf.ru/specialists/bulletins-nkcki/682935 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-15494 · Aviso do Fabricante
• https://osv.dev/vulnerability/USN-7569-1 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-15494 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-15494 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-84cm-x2q5-8225 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2018-15494 · Nota de Segurança
• https://ubuntu.com/security/CVE-2021-23450 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2019-10785 · Aviso do Fabricante
• https://ubuntu.com/security/notices/USN-7569-1 · Aviso do Fabricante
• https://lists.debian.org/debian-lts-announce/2018/09/msg00002.html · Nota