CVE-2010-2273
Cross-Site Scripting in dojo
CVE-2010-2273 is a medium vulnerability (CVSS 4.3) in Dojotoolkit Dojo, published June 14, 2010. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 4.54%, the 91st percentile. Fixed in dojo 1.13.1.
- Severity
- 4.3 MediumCVSS 2.0, NVD
- Exploit chance
- 4.54%EPSS, 91st percentile
- Exploitation
- None known1 public exploit
- Fixed in
1.13.1dojo +7 more
Description
Multiple cross-site scripting (XSS) vulnerabilities in Dojo 1.0.x before 1.0.3, 1.1.x before 1.1.2, 1.2.x before 1.2.4, 1.3.x before 1.3.3, and 1.4.x before 1.4.2 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, possibly related to dojo/resources/iframe_history.html, dojox/av/FLAudio.js, dojox/av/FLVideo.js, dojox/av/resources/audio.swf, dojox/av/resources/video.swf, util/buildscripts/jslib/build.js, and util/buildscripts/jslib/buildUtil.js, as demonstrated by the (1) dojoUrl and (2) testUrl parameters to util/doh/runner.html.
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
dojonpm | 1.13.0 to 1.13.0 | 1.13.1 |
dojonpm | 1.12.0 up to 1.12.4 | 1.12.4 |
dojonpm | 1.11.0 up to 1.11.6 | 1.11.6 |
dojonpm | 1.10.0 up to 1.10.10 | 1.10.10 |
dojoDebian:12 | before 1.4.2+dfsg-1 | 1.4.2+dfsg-1 |
dojoDebian:13 | before 1.4.2+dfsg-1 | 1.4.2+dfsg-1 |
dojoDebian:14 | before 1.4.2+dfsg-1 | 1.4.2+dfsg-1 |
dojonpm | 1.13.0 up to 1.13.1 | 1.13.1 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Dojo Toolkit 1.4.1 - '/doh/runner.html' Multiple Cross-Site Scripting Vulnerabilities | 2010-03-15 |
What each source reports
NVD Score used
Multiple cross-site scripting (XSS) vulnerabilities in Dojo 1.0.x before 1.0.3, 1.1.x before 1.1.2, 1.2.x before 1.2.4, 1.3.x before 1.3.3, and 1.4.x before 1.4.2 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, possibly related to dojo/resources/iframe_history.html, dojox/av/FLAudio.js, dojox/av/FLVideo.js, dojox/av/resources/audio.swf, dojox/av/resources/video.swf, util/buildscripts/jslib/build.js, and util/buildscripts/jslib/buildUtil.js, as demonstrated by the (1) dojoUrl and (2) testUrl parameters to util/doh/runner.html.
- Record
CVE-2010-2273- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE ListNo score
Multiple cross-site scripting (XSS) vulnerabilities in Dojo 1.0.x before 1.0.3, 1.1.x before 1.1.2, 1.2.x before 1.2.4, 1.3.x before 1.3.3, and 1.4.x before 1.4.2 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, possibly related to dojo/resources/iframe_history.html, dojox/av/FLAudio.js, dojox/av/FLVideo.js, dojox/av/resources/audio.swf, dojox/av/resources/video.swf, util/buildscripts/jslib/build.js, and util/buildscripts/jslib/buildUtil.js, as demonstrated by the (1) dojoUrl and (2) testUrl parameters to util/doh/runner.html.
- Record
CVE-2010-2273- Updated
- 2026-11-02
EUVDEUVD-2019-0651No score
Multiple cross-site scripting (XSS) vulnerabilities in Dojo 1.0.x before 1.0.3, 1.1.x before 1.1.2, 1.2.x before 1.2.4, 1.3.x before 1.3.3, and 1.4.x before 1.4.2 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, possibly related to dojo/resources/iframe_history.html, dojox/av/FLAudio.js, dojox/av/FLVideo.js, dojox/av/resources/audio.swf, dojox/av/resources/video.swf, util/buildscripts/jslib/build.js, and util/buildscripts/jslib/buildUtil.js, as demonstrated by the (1) dojoUrl and (2) testUrl parameters to util/doh/runner.html.
- Record
EUVD-2019-0651- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-536q-8gxx-m782No score
Cross-Site Scripting in dojo
Versions of dojo prior to 1.4.2 are vulnerable to DOM-based Cross-Site Scripting (XSS). The package does not sanitize URL parameters in the _testCommon.js and runner.html test files, allowing attackers to execute arbitrary JavaScript in the victim's browser.
Recommendation
Upgrade to version 1.4.2 or later.
- Record
GHSA-536q-8gxx-m782- Weakness
- CWE-79
- Updated
- 2026-11-02
OSVNo score
Multiple cross-site scripting (XSS) vulnerabilities in Dojo 1.0.x before 1.0.3, 1.1.x before 1.1.2, 1.2.x before 1.2.4, 1.3.x before 1.3.3, and 1.4.x before 1.4.2 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, possibly related to dojo/resources/iframe_history.html, dojox/av/FLAudio.js, dojox/av/FLVideo.js, dojox/av/resources/audio.swf, dojox/av/resources/video.swf, util/buildscripts/jslib/build.js, and util/buildscripts/jslib/buildUtil.js, as demonstrated by the (1) dojoUrl and (2) testUrl parameters to util/doh/runner.html.
- Record
CVE-2010-2273- Updated
- 2026-11-02
OSVDEBIAN-CVE-2010-2273No score
Multiple cross-site scripting (XSS) vulnerabilities in Dojo 1.0.x before 1.0.3, 1.1.x before 1.1.2, 1.2.x before 1.2.4, 1.3.x before 1.3.3, and 1.4.x before 1.4.2 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, possibly related to dojo/resources/iframe_history.html, dojox/av/FLAudio.js, dojox/av/FLVideo.js, dojox/av/resources/audio.swf, dojox/av/resources/video.swf, util/buildscripts/jslib/build.js, and util/buildscripts/jslib/buildUtil.js, as demonstrated by the (1) dojoUrl and (2) testUrl parameters to util/doh/runner.html.
- Record
DEBIAN-CVE-2010-2273- Updated
- 2026-11-02
OSVGHSA-536q-8gxx-m782No score
Cross-Site Scripting in dojo
Versions of dojo prior to 1.4.2 are vulnerable to DOM-based Cross-Site Scripting (XSS). The package does not sanitize URL parameters in the _testCommon.js and runner.html test files, allowing attackers to execute arbitrary JavaScript in the victim's browser.
Recommendation
Upgrade to version 1.4.2 or later.
- Record
GHSA-536q-8gxx-m782- Weakness
- CWE-79
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
vupen.com/english/advisories/2010/1281
www-1.ibm.com/support/docview.wss?uid=swg1LO50849
bugs.dojotoolkit.org/ticket/10773
Show 14 moreShow less
secunia.com/advisories/38964
dojotoolkit.org/blog/post/dylan/2010/03/dojo-security-advisory
gdssecurity.com/l/b/2010/03/12/multiple-dom-based-xss-in-dojo-toolkit-sdk
www-01.ibm.com/support/docview.wss?uid=swg21431472
github.com/dojo/dojo/pull/307
npmjs.com/advisories/972
nvd.nist.gov/vuln/detail/CVE-2010-2273
security-tracker.debian.org/tracker/CVE-2010-2273