NetSight
IP …
high7.7

CVE-2020-5259

Prototype Pollution in Dojox

Impact

The Dojox jQuery wrapper `jqMix` mixin method is vulnerable to Prototype Pollution. Affected Area: ``` //https://github.com/dojo/dojox/blob/master/jq.js#L442 var tobj = {}; for(var x in props){ // the "tobj" condition avoid copying properties in "props" // inherited from Object.prototype. For example, if obj has a custom // toString() method, don't overwrite it with the toString() method // that props inherited from Object.prototype if((tobj[x] === undefined || tobj[x] != props[x]) && props[x] !== undefined && obj != props[x]){ if(dojo.isObject(obj[x]) && dojo.isObject(props[x])){ if(dojo.isArray(props[x])){ obj[x] = props[x]; }else{ obj[x] = jqMix(obj[x], props[x]); } }else{ obj[x] = props[x]; } ```

Affected packages

EcosystemPackageAffectedFixed in
npmdojox< 1.11.101.11.10

Affected products

VendorProductAffected versions
LinuxfoundationDojox
before 1.11.10
from 1.12.0 before 1.12.8
from 1.13.0 before 1.13.7
from 1.14.0 before 1.14.6
from 1.15.0 before 1.15.3
from 1.16.0 before 1.16.2

Weakness classification

CWE-94CWE-74

References