PT-2018-2291 · Dojo Foundation · Dojo Toolkit

Imsebao · Published 2018-02-02 · Updated 2022-05-14 · CVE-2018-6561

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Dojo Toolkit version 1.13

Description The issue is related to the dijit.Editor component in Dojo Toolkit, which allows for cross-site scripting (XSS) attacks via the onload attribute of an SVG element. This can enable a remote attacker to perform cross-site scripting attacks.

Recommendations For Dojo Toolkit version 1.13, consider disabling the use of SVG elements with the onload attribute in the dijit.Editor component until a patch is available. Restrict access to the dijit.Editor component to minimize the risk of exploitation. Avoid using the onload attribute in SVG elements within the dijit.Editor component until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2019-00417

CVE-2018-6561

GHSA-WP32-WQ34-2RQH

Affected Products

Dojo Toolkit

References · 13

• 🔥 https://github.com/imsebao/404team/blob/master/dijit_editor_xss.md · Exploit
• https://osv.dev/vulnerability/GHSA-wp32-wq34-2rqh · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-00417 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2018-6561 · Security Note
• https://osv.dev/vulnerability/CVE-2018-6561 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2018-6561 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-6561 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2018-6561 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-6561 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-6561 · Vendor Advisory
• https://github.com/dojo/dijit · Note
• https://github.com/dojo/dijit/commit/d22d6cc3458c3c29d2d1fc44652b4bd7f10751f6 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-6561 · Note