PT-2020-5619 · Dojo+2 · Dojox+2

Published 2020-02-13 · Updated 2025-06-16 · CVE-2019-10785

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions dojox versions prior to 1.16.1 dojox versions prior to 1.15.2 dojox versions prior to 1.14.5 dojox versions prior to 1.13.6 dojox versions prior to 1.12.7 dojox versions prior to 1.11.9

Description The issue is related to the dojox.xmpp.util.xmlEncode function, which only encodes the first occurrence of each character, not all of them, leading to a potential Cross-site Scripting (XSS) vulnerability. This affects users of dojox/xmpp and dojox/dtl. The vulnerability may allow a remote attacker to impact the integrity of data.

Recommendations For dojox versions prior to 1.16.1, upgrade to version 1.16.1. For dojox versions prior to 1.15.2, upgrade to version 1.15.2. For dojox versions prior to 1.14.5, upgrade to version 1.14.5. For dojox versions prior to 1.13.6, upgrade to version 1.13.6. For dojox versions prior to 1.12.7, upgrade to version 1.12.7. For dojox versions prior to 1.11.9, upgrade to version 1.11.9. As a temporary workaround, the change applied in the patch could be added separately. Users of Dojo 1.10.x and earlier should review this change and determine if it impacts them, and backport the change as appropriate.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2021-01281

CVE-2019-10785

DLA-2127-1

GHSA-PG97-WW7H-5MJR

MGASA-2020-0126

SNYK-JS-DOJOX-548257

USN-7569-1

Affected Products

Linuxmint

Ubuntu

Dojox

References · 28

• 🔥 https://github.com/dojo/dojox/security/advisories/GHSA-pg97-ww7h-5mjr · Exploit
• https://osv.dev/vulnerability/MGASA-2020-0126 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-15494 · Vendor Advisory
• https://osv.dev/vulnerability/USN-7569-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2019-10785 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2020-0126.html · Security Note
• https://debian.org/lts/security/2020/dla-2127 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-10785 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-10785 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se16-bulletin-20210611SE16 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-10785 · Security Note
• https://ubuntu.com/security/CVE-2019-10785 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-7569-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2019-10785 · Security Note
• https://ubuntu.com/security/CVE-2020-4051 · Vendor Advisory