Is CVE-2008-6681 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2008-6681 being exploited in the wild.

How severe is CVE-2008-6681?

Informational severity, with a CVSS score of 4.3, published 1 September 2020.

Which products and versions are affected?

dojo (npm) SEMVER:introduced=0,fixed=1.1.0.

Is there a fix for CVE-2008-6681?

Yes. dojo (npm): upgrade to 1.1.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2008-6681 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2008-6681?

Check whether you run Dojo Foundation Dojo Toolkit or dojo (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2008-6681: Dojo cross-site scripting in dijit.Editor and textarea

CVE-2008-6681 · Severity: info · CVSS 4.3 · Published 2020-09-01

Dojo is a popular JavaScript library used to build interactive web applications. A security flaw in its text editor and textarea components allows attackers to run malicious scripts in a user's browser. This could lead to unauthorized actions being performed on behalf of the user or the theft of sensitive session information.

Technologies: dojo (npm). Vendors: npm.

Quick answers

Is CVE-2008-6681 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2008-6681 being exploited in the wild.
How severe is CVE-2008-6681?: Informational severity, with a CVSS score of 4.3, published 1 September 2020.
Which products and versions are affected?: dojo (npm) SEMVER:introduced=0,fixed=1.1.0.
Is there a fix for CVE-2008-6681?: Yes. dojo (npm): upgrade to 1.1.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2008-6681 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2008-6681?: Check whether you run Dojo Foundation Dojo Toolkit or dojo (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

dojo (npm): upgrade to 1.1.0 or later
```
npm install dojo@1.1.0
```

Technical details

A cross-site scripting (XSS) vulnerability exists in the dijit.Editor and textarea components of the Dojo Toolkit. The root cause is improper neutralization of input, specifically allowing XML entities within a TEXTAREA element to be executed as JavaScript even when sanitization is applied. A remote attacker can exploit this by injecting arbitrary web script or HTML. This vulnerability is resolved in Dojo version 1.1.0.

Affected products

Dojo Foundation dojo < 1.1.0

Identifiers

CVE-2008-6681
GHSA-39cx-xcwj-3rc4

Timeline

2009-04-09: disclosed: NVD publication date
2020-09-01: advisory: GitHub Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.