Is CVE-2010-2273 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2010-2273 being exploited in the wild.

How severe is CVE-2010-2273?

Informational severity, with a CVSS score of 0, published 11 September 2019.

Which products and versions are affected?

dojo (npm) SEMVER:introduced=1.13.0,fixed=1.13.1.

Is there a fix for CVE-2010-2273?

Yes. dojo (npm): upgrade to 1.13.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2010-2273 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2010-2273?

Check whether you run dojo (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2010-2273: Dojo DOM-based cross-site scripting in test files

CVE-2010-2273 · Severity: info · CVSS 0 · Published 2019-09-11

Dojo is a widely-used JavaScript framework for building web applications. Versions prior to 1.4.2 contain a DOM-based cross-site scripting (XSS) vulnerability in test and documentation files that fail to sanitize URL parameters. An attacker can craft a malicious link that, when clicked by a developer or user, executes arbitrary JavaScript in the victim's browser, potentially leading to account compromise, data theft, or malware installation.

Technologies: dojo (npm). Vendors: npm.

Quick answers

Is CVE-2010-2273 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2010-2273 being exploited in the wild.
How severe is CVE-2010-2273?: Informational severity, with a CVSS score of 0, published 11 September 2019.
Which products and versions are affected?: dojo (npm) SEMVER:introduced=1.13.0,fixed=1.13.1.
Is there a fix for CVE-2010-2273?: Yes. dojo (npm): upgrade to 1.13.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2010-2273 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2010-2273?: Check whether you run dojo (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

dojo (npm): upgrade to 1.13.1 or later
```
npm install dojo@1.13.1
```

Technical details

The vulnerability is a DOM-based XSS (CWE-79) present in Dojo test files (_testCommon.js and runner.html). The root cause is insufficient input sanitization of URL parameters before they are inserted into the DOM. An attacker can craft a URL containing malicious JavaScript payload; when a victim visits this URL while using the affected test files, the unsanitized parameter is reflected into the page, causing the attacker's script to execute in the victim's browser context. The vulnerability affects Dojo versions 1.10.0 through 1.13.0 (fixed in 1.10.10, 1.11.6, 1.12.4, and 1.13.1). While the threat is primarily limited to developers accessing test files rather than end-users of applications built with Dojo, exploitation could allow credential theft or code injection during development.

Affected products

Dojo Project Dojo Toolkit 1.10.0 to 1.10.9, 1.11.0 to 1.11.5, 1.12.0 to 1.12.3, 1.13.0

Identifiers

CVE-2010-2273
GHSA-536q-8gxx-m782

Timeline

2010-03: disclosed: Vulnerability publicly disclosed in Dojo security advisory
2018-08-10: patched: Fix merged in commit 9117ffd5a3863e44c92fcd58564c0da22be858f4

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.