In Dijit before versions 1.11.11, and greater than or equal to 1.12.0 and less than 1.12.9, and greater than or equal to 1.13.0 and less than 1.13.8, and greater than or equal to 1.14.0 and less than 1.14.7, and greater than or equal to 1.15.0 and less than 1.15.4, and greater than or equal to 1.16.0 and less than 1.16.3, there is a cross-site scripting vulnerability in the Editor's LinkDialog plugin. This has been fixed in 1.11.11, 1.12.9, 1.13.8, 1.14.7, 1.15.4, 1.16.3.

The remote Ubuntu 16.04 LTS / 20.04 LTS / 22.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7569-1 advisory.

    It was discovered that Dojo did not correctly handle DataGrids. An attacker could possibly use this issue     to execute arbitrary code. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS.

    (CVE-2018-15494)

    It was discovered that Dojo was vulnerable to prototype pollution. An attacker could possibly use this     issue to execute arbitrary code. (CVE-2021-23450)

    Jonathan Leitschuh discovered that Dojo did not correctly sanitize certain inputs. An attacker could     possibly use this issue to execute a cross-site scripting (XSS) attack. This issue only affected Ubuntu     16.04 LTS, Ubuntu 18.04 LTS and Ubuntu 20.04 LTS.

    (CVE-2019-10785, CVE-2020-4051)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3289 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-3289-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                       Guilhem Moulin     January 28, 2023                              https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : dojo     Version        : 1.14.2+dfsg1-1+deb10u3     CVE ID         : CVE-2020-4051 CVE-2021-23450     Debian Bug     : 970000 1014785

    Two vulnerabilities were found in dojo, a modular JavaScript toolkit,     that could result in information disclosure.

    CVE-2020-4051

        The Dijit Editor's LinkDialog plugin of dojo 1.14.0 to 1.14.7 is         vulnerable to cross-site scripting (XSS) attacks.

    CVE-2021-23450

        Prototype pollution vulnerability via the setObject() function.

    For Debian 10 buster, these problems have been fixed in version     1.14.2+dfsg1-1+deb10u3.

    We recommend that you upgrade your dojo packages.

    For the detailed security status of dojo please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/dojo

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
240163	Ubuntu 16.04 LTS / 20.04 LTS / 22.04 LTS : Dojo vulnerabilities (USN-7569-1)	Nessus	Ubuntu Local Security Checks	critical
170878	Debian dla-3289 : libjs-dojo-core - security update	Nessus	Debian Local Security Checks	critical

Detections

Analytics

CVE-2020-4051

medium

Tenable Plugins

critical

critical