Dojo Toolkit CVE-2014-8917 Multiple Cross Site Scripting Vulnerabilities

Bugtraq ID:	72903
Class:	Input Validation Error
CVE:	CVE-2014-8917
Remote:	Yes
Local:	No
Published:	Jan 19 2015 12:00AM
Updated:	Oct 26 2015 04:49PM
Credit:	IBM
Vulnerable:	IBM WebSphere Service Registry and Repository 7.5 IBM WebSphere Service Registry and Repository 7.0 IBM WebSphere Process Server 7 IBM Websphere Portal 6.1 IBM WebSphere Lombardi Edition 7.2.0 IBM WebSphere Enterprise Service Bus 7 IBM Tivoli Common Reporting 2.1 IBM Lotus Notes 8.5.3 IBM InfoSphere Information Analyzer 8.0 IBM eDiscovery Analyzer 2.2 IBM Cognos TM1 9.5.2
Not Vulnerable:

Dojo Toolkit CVE-2014-8917 Multiple Cross Site Scripting Vulnerabilities

Dojo Toolkit is prone to multiple cross-site scripting vulnerabilities because it fails to sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Dojo Toolkit CVE-2014-8917 Multiple Cross Site Scripting Vulnerabilities

An attacker can exploit these issues by enticing an unsuspecting user to visit a specially crafted URL.

Dojo Toolkit CVE-2014-8917 Multiple Cross Site Scripting Vulnerabilities

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Dojo Toolkit CVE-2014-8917 Multiple Cross Site Scripting Vulnerabilities

References:

• IBM Homepage (IBM)