PT-2018-9517 · Dojo · Doh

Bryanforbes · Published 2018-09-06 · Updated 2022-05-14 · CVE-2018-1000665

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Dojo Dojo Objective Harness (DOH) versions prior to 1.14

Description The issue is a Cross Site Scripting (XSS) vulnerability in unit.html, testsDOH/ base/loader/i18n-exhaustive/i18n-test/unit.html, and testsDOH/ base/i18nExhaustive.js. This can result in victims being attacked through their browser, potentially leading to malware delivery, HTTP cookie theft, and bypassing of CORS trust. The attack is typically exploitable when victims are lured to a website under the attacker's control, and the XSS vulnerability is silently exploited without the victim's knowledge.

Recommendations For versions prior to 1.14, update to version 1.14 or later to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable files unit.html, testsDOH/ base/loader/i18n-exhaustive/i18n-test/unit.html, and testsDOH/ base/i18nExhaustive.js to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2018-1000665

GHSA-VMQ9-CM7M-4P8P

Affected Products

Doh

References · 12

• https://ubuntu.com/security/CVE-2018-1000665 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-vmq9-cm7m-4p8p · Vendor Advisory
• https://dojotoolkit.org/blog/dojo-1-14-released · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-1000665 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-1000665 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2018-1000665 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-1000665 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2018-1000665 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-1000665 · Vendor Advisory
• https://github.com/dojo/dojo/pull/307 · Note
• https://github.com/dojo/dojo · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1000665 · Note