Alerts This Week
Warning Icon 1 714
Alerts This Week
Warning Icon 1 714

Mageia 8: MGASA-2023-0039 Critical Dojo XSS And Prototype Threats

mageia
Calendar Grey February 7, 2023
Dist Mageia Esm H88
Mageia 2023-0040 warns users about vulnerabilities in the CMS plugin regarding XSS attacks and prototype tampering threats. Keep informed on the patch details.
Dijit Editor's LinkDialog plugin of dojo 1.14.0 to 1.14.7 is vulnerable to cross-site scripting (XSS) attacks

Summary

Dijit Editor's LinkDialog plugin of dojo 1.14.0 to 1.14.7 is vulnerable to cross-site scripting (XSS) attacks. (CVE-2020-4051) Prototype pollution vulnerability via the setObject() function. (CVE-2021-23450)

References

- https://bugs.mageia.org/show_bug.cgi?id=31491

- https://github.com/dojo/dijit/security/advisories/GHSA-cxjc-r2fp-7mq6

- https://github.com/advisories/GHSA-m8gw-hjpr-rjv7

- https://www.cve.org/CVERecord?id=CVE-2020-4051

- https://www.cve.org/CVERecord?id=CVE-2021-23450

Topics%20covered

Topics Covered

security advisory critical software update cross-site scripting mageia prototype pollution dojo

Resolution

SRPMS

- 8/core/dojo-1.16.5-1.mga8

Severity
critical
Lowest
Low
Medium
High
Critical

Publication date: 07 Feb 2023
URL: https://advisories.mageia.org/MGASA-2023-0039.html
Type: security
CVE: CVE-2020-4051, CVE-2021-23450

Topics%20covered

Topics Covered

security advisory critical software update cross-site scripting mageia prototype pollution dojo

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here