GHSA-vmq9-cm7m-4p8p
Improper Neutralization of Input During Web Page Generation in Dojo Dojo Objective Harness
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Maven | org.dojotoolkit:dojo | < 1.14 | 1.14 |
Details
As written in the advisory (Markdown source, shown as plain text).
Dojo Dojo Objective Harness (DOH) version prior to version 1.14 contains a Cross Site Scripting (XSS) vulnerability in `unit.html` and `testsDOH/_base/loader/i18n-exhaustive/i18n-test/unit.html` and `testsDOH/_base/i18nExhaustive.js` in the DOH that can result in Victim attacked through their browser - deliver malware, steal HTTP cookies, bypass CORS trust. This attack appear to be exploitable via Victims are typically lured to a web site under the attacker's control; the XSS vulnerability on the target domain is silently exploited without the victim's knowledge. This vulnerability appears to have been fixed in 1.14.
References
External links from the advisory. They lead to third-party sites.