{"api_version":"1","generated_at":"2026-04-23T02:24:54+00:00","cve":"CVE-2020-4051","urls":{"html":"https://cve.report/CVE-2020-4051","api":"https://cve.report/api/cve/CVE-2020-4051.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2020-4051","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2020-4051"},"summary":{"title":"CVE-2020-4051","description":"In Dijit before versions 1.11.11, and greater than or equal to 1.12.0 and less than 1.12.9, and greater than or equal to 1.13.0 and less than 1.13.8, and greater than or equal to 1.14.0 and less than 1.14.7, and greater than or equal to 1.15.0 and less than 1.15.4, and greater than or equal to 1.16.0 and less than 1.16.3, there is a cross-site scripting vulnerability in the Editor's LinkDialog plugin. This has been fixed in 1.11.11, 1.12.9, 1.13.8, 1.14.7, 1.15.4, 1.16.3.","state":"PUBLIC","assigner":"security-advisories@github.com","published_at":"2020-06-15 22:15:00","updated_at":"2023-02-28 18:28:00"},"problem_types":["CWE-79"],"metrics":[],"references":[{"url":"https://github.com/dojo/dijit/commit/462bdcd60d0333315fe69ab4709c894d78f61301","name":"https://github.com/dojo/dijit/commit/462bdcd60d0333315fe69ab4709c894d78f61301","refsource":"MISC","tags":["Patch","Third Party Advisory"],"title":"Merge pull request from GHSA-cxjc-r2fp-7mq6 · dojo/dijit@462bdcd · GitHub","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://github.com/dojo/dijit/security/advisories/GHSA-cxjc-r2fp-7mq6","name":"https://github.com/dojo/dijit/security/advisories/GHSA-cxjc-r2fp-7mq6","refsource":"CONFIRM","tags":["Third Party Advisory"],"title":"XSS in dijit/editor  · Advisory · dojo/dijit · GitHub","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.oracle.com/security-alerts/cpuoct2020.html","name":"https://www.oracle.com/security-alerts/cpuoct2020.html","refsource":"MISC","tags":[],"title":"Oracle Critical Patch Update Advisory - October 2020","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://lists.debian.org/debian-lts-announce/2023/01/msg00030.html","name":"[debian-lts-announce] 20230129 [SECURITY] [DLA 3289-1] dojo security update","refsource":"MLIST","tags":[],"title":"[SECURITY] [DLA 3289-1] dojo security update","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"https://security.netapp.com/advisory/ntap-20201023-0003/","name":"https://security.netapp.com/advisory/ntap-20201023-0003/","refsource":"CONFIRM","tags":[],"title":"October 2020 MySQL Vulnerabilities in NetApp Products | NetApp Product Security","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-4051","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-4051","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2020","cve_id":"4051","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"debian","cpe5":"debian_linux","cpe6":"10.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2020","cve_id":"4051","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"netapp","cpe5":"active_iq_unified_manager","cpe6":"-","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"vmware_vsphere","cpe12":"*","cpe13":"*"},{"cve_year":"2020","cve_id":"4051","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"netapp","cpe5":"active_iq_unified_manager","cpe6":"-","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"windows","cpe12":"*","cpe13":"*"},{"cve_year":"2020","cve_id":"4051","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"netapp","cpe5":"oncommand_insight","cpe6":"-","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2020","cve_id":"4051","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"netapp","cpe5":"oncommand_workflow_automation","cpe6":"-","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2020","cve_id":"4051","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"netapp","cpe5":"snapcenter","cpe6":"-","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2020","cve_id":"4051","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"openjsf","cpe5":"dijit","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2020","cve_id":"4051","vulnerable":"1","versionEndIncluding":"1","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"openjsf","cpe5":"dijit","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[{"cve":"CVE-2020-4051","qid":"180769","title":"Debian Security Update for dojo (CVE-2020-4051)"},{"cve":"CVE-2020-4051","qid":"181515","title":"Debian Security Update for dojo (DLA 3289-1)"}]},"source_records":{"cve_program":{"CVE_data_meta":{"ASSIGNER":"security-advisories@github.com","ID":"CVE-2020-4051","STATE":"PUBLIC","TITLE":"XSS in Dijit Editor's LinkDialog plugin"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"dijit","version":{"version_data":[{"version_value":"< 1.11.11"},{"version_value":">= 1.12.0, < 1.12.9"},{"version_value":">= 1.13.0, < 1.13.8"},{"version_value":">= 1.14.0, < 1.14.7"},{"version_value":">= 1.15.0, < 1.15.4"},{"version_value":">= 1.16.0, < 1.16.3"}]}}]},"vendor_name":"Dojo"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"In Dijit before versions 1.11.11, and greater than or equal to 1.12.0 and less than 1.12.9, and greater than or equal to 1.13.0 and less than 1.13.8, and greater than or equal to 1.14.0 and less than 1.14.7, and greater than or equal to 1.15.0 and less than 1.15.4, and greater than or equal to 1.16.0 and less than 1.16.3, there is a cross-site scripting vulnerability in the Editor's LinkDialog plugin. This has been fixed in 1.11.11, 1.12.9, 1.13.8, 1.14.7, 1.15.4, 1.16.3."}]},"impact":{"cvss":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.7,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N","version":"3.1"}},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}]},"references":{"reference_data":[{"name":"https://github.com/dojo/dijit/security/advisories/GHSA-cxjc-r2fp-7mq6","refsource":"CONFIRM","url":"https://github.com/dojo/dijit/security/advisories/GHSA-cxjc-r2fp-7mq6"},{"name":"https://github.com/dojo/dijit/commit/462bdcd60d0333315fe69ab4709c894d78f61301","refsource":"MISC","url":"https://github.com/dojo/dijit/commit/462bdcd60d0333315fe69ab4709c894d78f61301"},{"url":"https://www.oracle.com/security-alerts/cpuoct2020.html","refsource":"MISC","name":"https://www.oracle.com/security-alerts/cpuoct2020.html"},{"refsource":"CONFIRM","name":"https://security.netapp.com/advisory/ntap-20201023-0003/","url":"https://security.netapp.com/advisory/ntap-20201023-0003/"},{"refsource":"MLIST","name":"[debian-lts-announce] 20230129 [SECURITY] [DLA 3289-1] dojo security update","url":"https://lists.debian.org/debian-lts-announce/2023/01/msg00030.html"}]},"source":{"advisory":"GHSA-cxjc-r2fp-7mq6","discovery":"UNKNOWN"}},"nvd":{"publishedDate":"2020-06-15 22:15:00","lastModifiedDate":"2023-02-28 18:28:00","problem_types":["CWE-79"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM"},"exploitabilityScore":2.3,"impactScore":2.7},"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:N/AC:M/Au:S/C:N/I:P/A:N","accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"SINGLE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE","baseScore":3.5},"severity":"LOW","exploitabilityScore":6.8,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:openjsf:dijit:*:*:*:*:*:*:*:*","versionStartIncluding":"1.16.0","versionEndExcluding":"1.16.3","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:openjsf:dijit:*:*:*:*:*:*:*:*","versionStartIncluding":"1.15.0","versionEndExcluding":"1.15.4","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:openjsf:dijit:*:*:*:*:*:*:*:*","versionStartIncluding":"1.14.0","versionEndExcluding":"1.14.7","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:openjsf:dijit:*:*:*:*:*:*:*:*","versionStartIncluding":"1.13.0","versionEndExcluding":"1.13.8","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:openjsf:dijit:*:*:*:*:*:*:*:*","versionStartIncluding":"1.12.0","versionEndExcluding":"1.12.9","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:openjsf:dijit:*:*:*:*:*:*:*:*","versionEndExcluding":"1.11.11","cpe_name":[]}]},{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*","cpe_name":[]}]},{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:*","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:*","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:*","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:*","cpe_name":[]}]}]}},"legacy_mitre":{"record":{"CveYear":"2020","CveId":"4051","Ordinal":"164044","Title":"CVE-2020-4051","CVE":"CVE-2020-4051","Year":"2020"},"notes":[{"CveYear":"2020","CveId":"4051","Ordinal":"1","NoteData":"In Dijit before versions 1.11.11, and greater than or equal to 1.12.0 and less than 1.12.9, and greater than or equal to 1.13.0 and less than 1.13.8, and greater than or equal to 1.14.0 and less than 1.14.7, and greater than or equal to 1.15.0 and less than 1.15.4, and greater than or equal to 1.16.0 and less than 1.16.3, there is a cross-site scripting vulnerability in the Editor's LinkDialog plugin. This has been fixed in 1.11.11, 1.12.9, 1.13.8, 1.14.7, 1.15.4, 1.16.3.","Type":"Description","Title":null},{"CveYear":"2020","CveId":"4051","Ordinal":"2","NoteData":"2020-06-15","Type":"Other","Title":"Published"},{"CveYear":"2020","CveId":"4051","Ordinal":"3","NoteData":"2020-10-23","Type":"Other","Title":"Modified"}]}}}