CVSS 3.1
5.4 mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NCVE-2020-4051
Medium (5.4). EPSS 1.2% chance of exploitation in the next 30 days. Fixed in dijit 1.11.11, 1.12.9, 1.13.8.
In Dijit before versions 1.11.11, and greater than or equal to 1.12.0 and less than 1.12.9, and greater than or equal to 1.13.0 and less than 1.13.8, and greater than or equal to 1.14.0 and less than 1.14.7, and greater than or equal to 1.15.0 and less than 1.15.4, and greater than or equal to 1.16.0 and less than 1.16.3, there is a cross-site scripting vulnerability in the Editor's LinkDialog plugin. This has been fixed in 1.11.11, 1.12.9, 1.13.8, 1.14.7, 1.15.4, 1.16.3.
Severity
- EPSS
- 1.2% chance of exploitation in the next 30 days; higher than 67% of CVEs (scores of 2026-10-31)
- CWE
- CWE-79
- Published
- Modified
- Record from
- the NVD, synced
Affected
- debian:debian_linux
- netapp:active_iq_unified_manager
- netapp:oncommand_insight
- netapp:oncommand_workflow_automation
- netapp:snapcenter
- openjsf:dijit
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-cxjc-r2fp-7mq6 | npm | dijit | <1.11.11 | 1.11.11 |
| GHSA-cxjc-r2fp-7mq6 | npm | dijit | >=1.12.0 <1.12.9 | 1.12.9 |
| GHSA-cxjc-r2fp-7mq6 | npm | dijit | >=1.13.0 <1.13.8 | 1.13.8 |
| GHSA-cxjc-r2fp-7mq6 | npm | dijit | >=1.14.0 <1.14.7 | 1.14.7 |
| GHSA-cxjc-r2fp-7mq6 | npm | dijit | >=1.15.0 <1.15.4 | 1.15.4 |
| GHSA-cxjc-r2fp-7mq6 | npm | dijit | >=1.16.0 <1.16.3 | 1.16.3 |
References
- https://github.com/dojo/dijit/commit/462bdcd60d0333315fe69ab4709c894d78f61301
- https://github.com/dojo/dijit/security/advisories/GHSA-cxjc-r2fp-7mq6
- https://lists.debian.org/debian-lts-announce/2023/01/msg00030.html
- https://security.netapp.com/advisory/ntap-20201023-0003/
- https://www.oracle.com/security-alerts/cpuoct2020.html