CVE-2020-4051

Katalog CVE

CVSS 5.4 · Medium EPSS 1,2%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada openjsf dijit, debian linux +4 lainnya. Skor CVSS 3.1 5.4 (Medium) menurut NVD.

Deskripsi (NVD)

In Dijit before versions 1.11.11, and greater than or equal to 1.12.0 and less than 1.12.9, and greater than or equal to 1.13.0 and less than 1.13.8, and greater than or equal to 1.14.0 and less than 1.14.7, and greater than or equal to 1.15.0 and less than 1.15.4, and greater than or equal to 1.16.0 and less than 1.16.3, there is a cross-site scripting vulnerability in the Editor's LinkDialog plugin. This has been fixed in 1.11.11, 1.12.9, 1.13.8, 1.14.7, 1.15.4, 1.16.3.

Rincian

Terbit di NVD

15 Juni 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

5.4 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

EPSS (30 hari)

1,2% peluang dieksploitasi; lebih tinggi dari 66,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/dojo/dijit/commit/462bdcd60d0333315fe69ab4709c894d78f61301 patch · advisory pihak ketiga
• https://www.oracle.com/security-alerts/cpuoct2020.html patch · advisory pihak ketiga
• https://github.com/dojo/dijit/security/advisories/GHSA-cxjc-r2fp-7mq6 advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2023/01/msg00030.html mailing list · advisory pihak ketiga
• https://security.netapp.com/advisory/ntap-20201023-0003/ advisory pihak ketiga