CVE-2010-2273
Multiple cross-site scripting (XSS) vulnerabilities in Dojo 1.0.x before 1.0.3, 1.1.x before 1.1.2, 1.2.x before 1.2.4, 1.3.x before 1.3.3, and 1.4.x before 1.4.2 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, possibly related to dojo/resources/iframe_history.html, dojox/av/FLAudio.js, dojox/av/FLVideo.js, dojox/av/resources/audio.swf, dojox/av/resources/video.swf, util/buildscripts/jslib/build.js, and util/buildscripts/jslib/buildUtil.js, as demonstrated by the (1) dojoUrl and (2) testUrl parameters to util/doh/runner.html.
- EPSS
- 4.5% chance of exploitation in the next 30 days; higher than 91% of CVEs (scores of 2026-10-31)
- CWE
- CWE-79
- Published
- Modified
- Record from
- the NVD, synced
Affected
- dojotoolkit:dojo
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-536q-8gxx-m782 | npm | dojo | >=1.13.0 <1.13.1 | 1.13.1 |
| GHSA-536q-8gxx-m782 | npm | dojo | >=1.12.0 <1.12.4 | 1.12.4 |
| GHSA-536q-8gxx-m782 | npm | dojo | >=1.11.0 <1.11.6 | 1.11.6 |
| GHSA-536q-8gxx-m782 | npm | dojo | >=1.10.0 <1.10.10 | 1.10.10 |