CVE-2019-10785

medium

Description

dojox is vulnerable to Cross-site Scripting in all versions before version 1.16.1, 1.15.2, 1.14.5, 1.13.6, 1.12.7 and 1.11.9. This is due to dojox.xmpp.util.xmlEncode only encoding the first occurrence of each character, not all of them.

References

https://github.com/CQ-Tools/CVE-2019-10785-unfixed

https://github.com/CQ-Tools/CVE-2019-10785-fixed

https://github.com/advisories/GHSA-pg97-ww7h-5mjr

https://snyk.io/vuln/SNYK-JS-DOJOX-548257%2C

https://lists.debian.org/debian-lts-announce/2020/02/msg00033.html

https://github.com/dojo/dojox/security/advisories/GHSA-pg97-ww7h-5mjr

Details

Source: Mitre, NVD

Published: 2020-02-13

Updated: 2026-06-17

Risk Information

CVSS v2

Base Score: 4.3

Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N

Severity: Medium

CVSS v3

Base Score: 6.1

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N