Dojo 'dijit.Editor' Cross Site Scripting Vulnerability
BID:34661
Info
Dojo 'dijit.Editor' Cross Site Scripting Vulnerability
| Bugtraq ID: | 34661 |
| Class: | Input Validation Error |
| CVE: |
CVE-2008-6681 |
| Remote: | Yes |
| Local: | No |
| Published: | Feb 06 2008 12:00AM |
| Updated: | Apr 23 2009 04:06PM |
| Credit: | unknown |
| Vulnerable: |
The Dojo Foundation Dojo 0.9 The Dojo Foundation Dojo 0.4.3 The Dojo Foundation Dojo 0.4.2 The Dojo Foundation Dojo 0.4.1 The Dojo Foundation Dojo 1.0 |
| Not Vulnerable: |
The Dojo Foundation Dojo 1.1 |
Discussion
Dojo 'dijit.Editor' Cross Site Scripting Vulnerability
Dojo is prone to a cross-site scripting vulnerability.
An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site and to steal cookie-based authentication credentials.
Versions prior to Dojo 1.1 are vulnerable.
Dojo is prone to a cross-site scripting vulnerability.
An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site and to steal cookie-based authentication credentials.
Versions prior to Dojo 1.1 are vulnerable.
Exploit / POC
Dojo 'dijit.Editor' Cross Site Scripting Vulnerability
An attacker can exploit this issue by enticing an unsuspecting victim to follow a malicious URI.
An attacker can exploit this issue by enticing an unsuspecting victim to follow a malicious URI.
Solution / Fix
Dojo 'dijit.Editor' Cross Site Scripting Vulnerability
Solution:
The vendor released Dojo 1.1 to address this issue. Please see the references for more information.
Solution:
The vendor released Dojo 1.1 to address this issue. Please see the references for more information.
References
Dojo 'dijit.Editor' Cross Site Scripting Vulnerability
References:
References:
- Dojo 1.1 Release Notes (The Dojo Foundation)
- Dojo Toolkit Homepage (The Dojo Foundation)
- Editor widget vulnerable to XSS attacks (The Dojo Foundation)