PT-2010-3862 · Dojo Foundation · Dojo

Published 2010-06-14 · Updated 2010-06-16 · CVE-2010-2276

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Dojo versions 0.4.x through 0.4.3 Dojo versions 1.0.x through 1.0.2 Dojo versions 1.1.x through 1.1.1 Dojo versions 1.2.x through 1.2.3 Dojo versions 1.3.x through 1.3.2 Dojo versions 1.4.x through 1.4.1

Description The default configuration of the build process in Dojo has the copyTests=true and mini=false options, which makes it easier for remote attackers to have an unspecified impact via a request to a test or demo component.

Recommendations For Dojo versions 0.4.x through 0.4.3, update to version 0.4.4 or later. For Dojo versions 1.0.x through 1.0.2, update to version 1.0.3 or later. For Dojo versions 1.1.x through 1.1.1, update to version 1.1.2 or later. For Dojo versions 1.2.x through 1.2.3, update to version 1.2.4 or later. For Dojo versions 1.3.x through 1.3.2, update to version 1.3.3 or later. For Dojo versions 1.4.x through 1.4.1, update to version 1.4.2 or later.

Fix

Weakness Enumeration

CWE-16

Related Identifiers

CVE-2010-2276

Affected Products

Dojo

References · 14

• http://www-1.ibm.com/support/docview.wss?uid=swg1LO50994 · Vendor Advisory
• http://www-1.ibm.com/support/docview.wss?uid=swg1LO50932 · Vendor Advisory
• http://www-1.ibm.com/support/docview.wss?uid=swg1LO50958 · Vendor Advisory
• http://www-1.ibm.com/support/docview.wss?uid=swg1LO50849 · Vendor Advisory
• http://www-1.ibm.com/support/docview.wss?uid=swg1LO50896 · Vendor Advisory
• http://www-1.ibm.com/support/docview.wss?uid=swg1LO50833 · Vendor Advisory
• http://secunia.com/advisories/38964 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-2276 · Security Note
• http://dojotoolkit.org/blog/post/dylan/2010/03/dojo-security-advisory · Vendor Advisory
• http://secunia.com/advisories/40007 · Vendor Advisory
• http://vupen.com/english/advisories/2010/1281 · Vendor Advisory
• http://www-1.ibm.com/support/docview.wss?uid=swg1LO50856 · Vendor Advisory
• http://www-01.ibm.com/support/docview.wss?uid=swg21431472 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2276 · Note