bugs.dojotoolkit.orgConfirmation
http://bugs.dojotoolkit.org/ticket/10773 CVE-2010-2275
Dojo Toolkit 1.4.1 - '/dijit/tests/_testCommon.js?theme' Cross-Site Scripting
Record summary
CVE-2010-2275 has a selected CVSS score of 4.3; EIP currently links 1 catalogued exploit.
Description
Cross-site scripting (XSS) vulnerability in dijit/tests/_testCommon.js in Dojo Toolkit SDK before 1.4.2 allows remote attackers to inject arbitrary web script or HTML via the theme parameter, as demonstrated by an attack against dijit/tests/form/test_Button.html.
Description source: CVE List
Exploitation context
Available material
- Catalogued exploits
- 1
Proofs of concept
1Catalogued exploits
ExploitDBDojo Toolkit 1.4.1 - '/dijit/tests/_testCommon.js?theme' Cross-Site ScriptingExploitDB exploitby Adam BixbyNot analyzed1 file
References
Showing 12 of 1438964Third-party advisory
http://secunia.com/advisories/38964 40007Third-party advisory
http://secunia.com/advisories/40007 www-01.ibm.comConfirmation
http://www-01.ibm.com/support/docview.wss?uid=swg21431472 LO50833Vendor advisory
http://www-1.ibm.com/support/docview.wss?uid=swg1LO50833 LO50849Vendor advisory
http://www-1.ibm.com/support/docview.wss?uid=swg1LO50849 LO50856Vendor advisory
http://www-1.ibm.com/support/docview.wss?uid=swg1LO50856 LO50896Vendor advisory
http://www-1.ibm.com/support/docview.wss?uid=swg1LO50896 LO50932Vendor advisory
http://www-1.ibm.com/support/docview.wss?uid=swg1LO50932 LO50958Vendor advisory
http://www-1.ibm.com/support/docview.wss?uid=swg1LO50958 LO50994Vendor advisory
http://www-1.ibm.com/support/docview.wss?uid=swg1LO50994 gdssecurity.com
http://www.gdssecurity.com/l/b/2010/03/12/multiple-dom-based-xss-in-dojo-toolkit-sdk