CVE-2020-5259
HIGHdojox < 1.11.10 - Prototype Pollution via jqMix Method
Title source: llmDescription
In affected versions of dojox (NPM package), the jqMix method is vulnerable to Prototype Pollution. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. This has been patched in versions 1.11.10, 1.12.8, 1.13.7, 1.14.6, 1.15.3 and 1.16.2
References (3)
Core 3
Core References
Exploit, Third Party Advisory x_refsource_confirm
https://github.com/dojo/dojox/security/advisories/GHSA-3hw5-q855-g6cw
Patch x_refsource_misc
https://github.com/dojo/dojox/commit/47d1b302b5b23d94e875b77b9b9a8c4f5622c9da
Mailing List mailing-list
x_refsource_mlist
https://lists.debian.org/debian-lts-announce/2020/03/msg00012.html
Scores
CVSS v3
7.7
EPSS
0.0198
EPSS Percentile
78.0%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N
Details
CWE
CWE-74
CWE-94
Status
published
Products (2)
linuxfoundation/dojox
< 1.11.10
npm/dojox
0 - 1.11.10npm
Published
Mar 10, 2020
Tracked Since
Feb 18, 2026