PT-2010-3860 · Dojo Foundation · Dojo

Published 2010-06-14 · Updated 2022-05-17 · CVE-2010-2274

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Dojo versions 1.0.x through 1.0.2 Dojo versions 1.1.x through 1.1.1 Dojo versions 1.2.x through 1.2.3 Dojo versions 1.3.x through 1.3.2 Dojo versions 1.4.x through 1.4.1

Description The issue allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors, possibly related to files such as dojo/resources/iframe history.html, dojox/av/FLAudio.js, dojox/av/FLVideo.js, dojox/av/resources/audio.swf, dojox/av/resources/video.swf, util/buildscripts/jslib/build.js, util/buildscripts/jslib/buildUtil.js, and util/doh/runner.html.

Recommendations For Dojo versions 1.0.x through 1.0.2, update to version 1.0.3 or later. For Dojo versions 1.1.x through 1.1.1, update to version 1.1.2 or later. For Dojo versions 1.2.x through 1.2.3, update to version 1.2.4 or later. For Dojo versions 1.3.x through 1.3.2, update to version 1.3.3 or later. For Dojo versions 1.4.x through 1.4.1, update to version 1.4.2 or later.

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2010-2274

GHSA-MMJH-45VJ-HFVF

Affected Products

Dojo

References · 21

• http://www-1.ibm.com/support/docview.wss?uid=swg1LO50849 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-2274 · Security Note
• http://www-1.ibm.com/support/docview.wss?uid=swg1LO50994 · Vendor Advisory
• http://dojotoolkit.org/blog/post/dylan/2010/03/dojo-security-advisory · Vendor Advisory
• http://www-1.ibm.com/support/docview.wss?uid=swg1LO50856 · Vendor Advisory
• http://www-1.ibm.com/support/docview.wss?uid=swg1LO50958 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2010-2274 · Vendor Advisory
• http://www-1.ibm.com/support/docview.wss?uid=swg1LO50833 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2010-2274 · Vendor Advisory
• http://vupen.com/english/advisories/2010/1281 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-mmjh-45vj-hfvf · Vendor Advisory
• http://www-1.ibm.com/support/docview.wss?uid=swg1LO50896 · Vendor Advisory
• http://www-1.ibm.com/support/docview.wss?uid=swg1LO50932 · Vendor Advisory
• http://secunia.com/advisories/38964 · Vendor Advisory
• http://secunia.com/advisories/40007 · Vendor Advisory