Is CVE-2020-5259 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2020-5259 being exploited in the wild.

How severe is CVE-2020-5259?

Low severity, with a CVSS score of 3.1, published 10 March 2020.

Which products and versions are affected?

Dojo dojox <1.11.10, 1.12.0-1.12.7, 1.13.0-1.13.6, 1.14.0-1.14.5, 1.15.0-1.15.2, 1.16.0-1.16.1.

Is there a fix for CVE-2020-5259?

A patch was published on 2020-03-10. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2020-5259 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2020-5259?

Check whether you run Dojo Foundation Dojo SDK. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2020-5259: Dojo Dojox prototype pollution in jqMix

Q: Which products and versions are affected?

Dojo dojox <1.11.10, 1.12.0-1.12.7, 1.13.0-1.13.6, 1.14.0-1.14.5, 1.15.0-1.15.2, 1.16.0-1.16.1.

Q: Is there a fix for CVE-2020-5259?

A patch was published on 2020-03-10. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2020-5259 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2020-5259?

Check whether you run Dojo Foundation Dojo SDK. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2020-5259 · Severity: low · CVSS 3.1 · Published 2020-03-10

A vulnerability exists in the Dojox library, a set of extensions for the Dojo JavaScript framework used to build web applications. An attacker can exploit this flaw to inject malicious properties into the application's core data structures. This can lead to unauthorized modification of application behavior or data, potentially compromising the integrity of the web service.

Quick answers

Is CVE-2020-5259 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2020-5259 being exploited in the wild.
How severe is CVE-2020-5259?: Low severity, with a CVSS score of 3.1, published 10 March 2020.
Which products and versions are affected?: Dojo dojox <1.11.10, 1.12.0-1.12.7, 1.13.0-1.13.6, 1.14.0-1.14.5, 1.15.0-1.15.2, 1.16.0-1.16.1.
Is there a fix for CVE-2020-5259?: A patch was published on 2020-03-10. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2020-5259 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2020-5259?: Check whether you run Dojo Foundation Dojo SDK. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The jqMix mixin method in the Dojox jQuery wrapper fails to properly sanitize property names during object merging. Specifically, it does not block the '__proto__' property, allowing an attacker to perform Prototype Pollution. By providing a specially crafted object to jqMix, a remote attacker can overwrite or add properties to the base Object prototype. This can lead to various impacts depending on the application's logic, including bypass of security checks or remote code execution in some environments. The vulnerability is fixed by explicitly checking for and rejecting the '__proto__' key during the mixin process.

Affected products

Dojo dojox <1.11.10, 1.12.0-1.12.7, 1.13.0-1.13.6, 1.14.0-1.14.5, 1.15.0-1.15.2, 1.16.0-1.16.1

Identifiers

CVE-2020-5259
GHSA-3hw5-q855-g6cw

Timeline

2020-03-10: advisory
2020-03-10: disclosed
2020-03-10: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.