low3.7
CVE-2020-4051
Cross-site Scripting in dijit editor's LinkDialog plugin
Impact
### Impact XSS possible for users of the Dijit Editor's LinkDialog plugin ### Patches Yes, 1.11.11, 1.12.9, 1.13.8, 1.14.7, 1.15.4, 1.16.3 ### Workarounds Users may apply the patch made in these releases. ### For more information If you have any questions or comments about this advisory, open an issue in [dojo/dijit](https://github.com/dojo/dijit/)
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | dijit | < 1.11.11 | 1.11.11 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Openjsf | Dijit | before 1.11.11 from 1.12.0 before 1.12.9 from 1.13.0 before 1.13.8 from 1.14.0 before 1.14.7 from 1.15.0 before 1.15.4 from 1.16.0 before 1.16.3 |
| Debian | Debian Linux | Version 10.0 |
| Netapp | Active Iq Unified Manager | All versions |
| Netapp | Oncommand Insight | All versions |
| Netapp | Oncommand Workflow Automation | All versions |
| Netapp | Snapcenter | All versions |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/dojo/dijit/commit/462bdcd60d0333315fe69ab4709c894d78f61301
- https://github.com/dojo/dijit/security/advisories/GHSA-cxjc-r2fp-7mq6
- https://lists.debian.org/debian-lts-announce/2023/01/msg00030.html
- https://security.netapp.com/advisory/ntap-20201023-0003/
- https://www.oracle.com/security-alerts/cpuoct2020.html
- https://github.com/advisories/GHSA-cxjc-r2fp-7mq6
- https://nvd.nist.gov/vuln/detail/CVE-2020-4051