{"id":"CVE-2010-2273","aliases":["DEBIAN-CVE-2010-2273","EUVD-2019-0651","GHSA-536q-8gxx-m782"],"status":"published","title":"Cross-Site Scripting in dojo","description":"Multiple cross-site scripting (XSS) vulnerabilities in Dojo 1.0.x before 1.0.3, 1.1.x before 1.1.2, 1.2.x before 1.2.4, 1.3.x before 1.3.3, and 1.4.x before 1.4.2 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, possibly related to dojo/resources/iframe_history.html, dojox/av/FLAudio.js, dojox/av/FLVideo.js, dojox/av/resources/audio.swf, dojox/av/resources/video.swf, util/buildscripts/jslib/build.js, and util/buildscripts/jslib/buildUtil.js, as demonstrated by the (1) dojoUrl and (2) testUrl parameters to util/doh/runner.html.","severity":{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.04545,"percentile":0.9163,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-79"],"published":"2010-06-14T19:00:00Z","modified":"2026-10-23T17:47:49Z","exploits":[{"source":"exploitdb","id":"EDB-33765","title":"Dojo Toolkit 1.4.1 - '/doh/runner.html' Multiple Cross-Site Scripting Vulnerabilities","type":"webapps","platform":"multiple","date":"2010-03-15","verified":true,"url":"https://www.exploit-db.com/exploits/33765"}],"fixes":[{"ecosystem":"npm","package":"dojo","fixed_in":["1.13.1","1.12.4","1.11.6","1.10.10"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"dojo","fixed_in":["1.4.2+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"dojo","fixed_in":["1.4.2+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"dojo","fixed_in":["1.4.2+dfsg-1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"dojo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.13.0"},{"last_affected":"1.13.0"},{"fixed":"1.13.1"}]}],"versions":["1.13.0"]},{"source":"ghsa","ecosystem":"npm","package":"dojo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.12.0"},{"fixed":"1.12.4"}]}]},{"source":"ghsa","ecosystem":"npm","package":"dojo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.11.0"},{"fixed":"1.11.6"}]}]},{"source":"ghsa","ecosystem":"npm","package":"dojo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.10.0"},{"fixed":"1.10.10"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"dojo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.2+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"dojo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.2+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"dojo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.2+dfsg-1"}]}]},{"source":"osv","ecosystem":"npm","package":"dojo","ranges":[{"type":"SEMVER","events":[{"introduced":"1.13.0"},{"fixed":"1.13.1"}]}],"versions":["1.13.0"]},{"source":"osv","ecosystem":"npm","package":"dojo","ranges":[{"type":"SEMVER","events":[{"introduced":"1.12.0"},{"fixed":"1.12.4"}]}]},{"source":"osv","ecosystem":"npm","package":"dojo","ranges":[{"type":"SEMVER","events":[{"introduced":"1.11.0"},{"fixed":"1.11.6"}]}]},{"source":"osv","ecosystem":"npm","package":"dojo","ranges":[{"type":"SEMVER","events":[{"introduced":"1.10.0"},{"fixed":"1.10.10"}]}]}],"products":[{"vendor":"dojotoolkit","product":"dojo"}],"references":[{"url":"http://www.vupen.com/english/advisories/2010/1281","tags":["vdb-entry","x_refsource_VUPEN","x_transferred","Vendor Advisory","advisory","web"]},{"url":"http://www-1.ibm.com/support/docview.wss?uid=swg1LO50849","tags":["vendor-advisory","x_refsource_AIXAPAR","x_transferred","web"]},{"url":"http://www-1.ibm.com/support/docview.wss?uid=swg1LO50932","tags":["vendor-advisory","x_refsource_AIXAPAR","x_transferred","web"]},{"url":"http://bugs.dojotoolkit.org/ticket/10773","tags":["x_refsource_CONFIRM","x_transferred","Exploit","evidence","web"]},{"url":"http://www-1.ibm.com/support/docview.wss?uid=swg1LO50994","tags":["vendor-advisory","x_refsource_AIXAPAR","x_transferred","web"]},{"url":"http://www-1.ibm.com/support/docview.wss?uid=swg1LO50833","tags":["vendor-advisory","x_refsource_AIXAPAR","x_transferred","web"]},{"url":"http://secunia.com/advisories/38964","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory","advisory","web"]},{"url":"http://www-1.ibm.com/support/docview.wss?uid=swg1LO50958","tags":["vendor-advisory","x_refsource_AIXAPAR","x_transferred","web"]},{"url":"http://www-1.ibm.com/support/docview.wss?uid=swg1LO50856","tags":["vendor-advisory","x_refsource_AIXAPAR","x_transferred","web"]},{"url":"http://dojotoolkit.org/blog/post/dylan/2010/03/dojo-security-advisory/","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory","advisory","fix"]},{"url":"http://www-1.ibm.com/support/docview.wss?uid=swg1LO50896","tags":["vendor-advisory","x_refsource_AIXAPAR","x_transferred","web"]},{"url":"http://secunia.com/advisories/40007","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory","advisory","web"]},{"url":"http://www.gdssecurity.com/l/b/2010/03/12/multiple-dom-based-xss-in-dojo-toolkit-sdk/","tags":["x_refsource_MISC","x_transferred","Exploit","evidence"]},{"url":"http://www-01.ibm.com/support/docview.wss?uid=swg21431472","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://github.com/dojo/dojo/pull/307","tags":["web"]},{"url":"https://github.com/dojo/dojo/commit/9117ffd5a3863e44c92fcd58564c0da22be858f4","tags":["web"]},{"url":"https://bugs.dojotoolkit.org/ticket/10773","tags":["web"]},{"url":"https://www.npmjs.com/advisories/972","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2010-2273","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-536q-8gxx-m782"},{"url":"https://security-tracker.debian.org/tracker/CVE-2010-2273","tags":["advisory"]},{"url":"http://dojotoolkit.org/blog/post/dylan/2010/03/dojo-security-advisory","tags":["web"]},{"url":"http://www.gdssecurity.com/l/b/2010/03/12/multiple-dom-based-xss-in-dojo-toolkit-sdk","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2010-2273","description":"Multiple cross-site scripting (XSS) vulnerabilities in Dojo 1.0.x before 1.0.3, 1.1.x before 1.1.2, 1.2.x before 1.2.4, 1.3.x before 1.3.3, and 1.4.x before 1.4.2 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, possibly related to dojo/resources/iframe_history.html, dojox/av/FLAudio.js, dojox/av/FLVideo.js, dojox/av/resources/audio.swf, dojox/av/resources/video.swf, util/buildscripts/jslib/build.js, and util/buildscripts/jslib/buildUtil.js, as demonstrated by the (1) dojoUrl and (2) testUrl parameters to util/doh/runner.html.","status":"published","published":"2010-06-14T19:00:00Z","modified":"2024-09-16T16:28:07.132Z","updated_at":"2026-11-02T14:33:27.01833Z"}],"euvd":[{"id":"EUVD-2019-0651","description":"Multiple cross-site scripting (XSS) vulnerabilities in Dojo 1.0.x before 1.0.3, 1.1.x before 1.1.2, 1.2.x before 1.2.4, 1.3.x before 1.3.3, and 1.4.x before 1.4.2 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, possibly related to dojo/resources/iframe_history.html, dojox/av/FLAudio.js, dojox/av/FLVideo.js, dojox/av/resources/audio.swf, dojox/av/resources/video.swf, util/buildscripts/jslib/build.js, and util/buildscripts/jslib/buildUtil.js, as demonstrated by the (1) dojoUrl and (2) testUrl parameters to util/doh/runner.html.","status":"published","published":"2010-06-14T19:00:00Z","modified":"2024-09-16T16:28:07Z","updated_at":"2026-11-03T00:55:51.557415Z"}],"ghsa":[{"id":"GHSA-536q-8gxx-m782","title":"Cross-Site Scripting in dojo","description":"Versions of `dojo` prior to 1.4.2 are vulnerable to DOM-based Cross-Site Scripting (XSS). The package does not sanitize URL parameters in the `_testCommon.js` and `runner.html` test files, allowing attackers to execute arbitrary JavaScript in the victim's browser.\n\n\n## Recommendation\n\nUpgrade to version 1.4.2 or later.","status":"published","published":"2019-09-11T23:02:57Z","modified":"2023-01-09T05:01:55Z","cwes":["CWE-79"],"updated_at":"2026-11-02T14:36:02.073372Z"}],"nvd":[{"id":"CVE-2010-2273","description":"Multiple cross-site scripting (XSS) vulnerabilities in Dojo 1.0.x before 1.0.3, 1.1.x before 1.1.2, 1.2.x before 1.2.4, 1.3.x before 1.3.3, and 1.4.x before 1.4.2 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, possibly related to dojo/resources/iframe_history.html, dojox/av/FLAudio.js, dojox/av/FLVideo.js, dojox/av/resources/audio.swf, dojox/av/resources/video.swf, util/buildscripts/jslib/build.js, and util/buildscripts/jslib/buildUtil.js, as demonstrated by the (1) dojoUrl and (2) testUrl parameters to util/doh/runner.html.","status":"published","published":"2010-06-15T14:30:01.42Z","modified":"2026-06-16T23:20:26.283Z","cvss":[{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:01:47.724369Z"}],"osv":[{"id":"CVE-2010-2273","description":"Multiple cross-site scripting (XSS) vulnerabilities in Dojo 1.0.x before 1.0.3, 1.1.x before 1.1.2, 1.2.x before 1.2.4, 1.3.x before 1.3.3, and 1.4.x before 1.4.2 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, possibly related to dojo/resources/iframe_history.html, dojox/av/FLAudio.js, dojox/av/FLVideo.js, dojox/av/resources/audio.swf, dojox/av/resources/video.swf, util/buildscripts/jslib/build.js, and util/buildscripts/jslib/buildUtil.js, as demonstrated by the (1) dojoUrl and (2) testUrl parameters to util/doh/runner.html.","status":"published","published":"2010-06-15T14:30:01Z","modified":"2026-04-10T03:41:16.547979Z","updated_at":"2026-11-02T15:43:57.991581Z"},{"id":"DEBIAN-CVE-2010-2273","description":"Multiple cross-site scripting (XSS) vulnerabilities in Dojo 1.0.x before 1.0.3, 1.1.x before 1.1.2, 1.2.x before 1.2.4, 1.3.x before 1.3.3, and 1.4.x before 1.4.2 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, possibly related to dojo/resources/iframe_history.html, dojox/av/FLAudio.js, dojox/av/FLVideo.js, dojox/av/resources/audio.swf, dojox/av/resources/video.swf, util/buildscripts/jslib/build.js, and util/buildscripts/jslib/buildUtil.js, as demonstrated by the (1) dojoUrl and (2) testUrl parameters to util/doh/runner.html.","status":"published","published":"2010-06-15T14:30:01.42Z","modified":"2026-10-23T17:47:49.903028752Z","updated_at":"2026-11-02T15:45:24.316685Z"},{"id":"GHSA-536q-8gxx-m782","title":"Cross-Site Scripting in dojo","description":"Versions of `dojo` prior to 1.4.2 are vulnerable to DOM-based Cross-Site Scripting (XSS). The package does not sanitize URL parameters in the `_testCommon.js` and `runner.html` test files, allowing attackers to execute arbitrary JavaScript in the victim's browser.\n\n\n## Recommendation\n\nUpgrade to version 1.4.2 or later.","status":"published","published":"2019-09-11T23:02:57Z","modified":"2023-11-08T03:56:56.454372Z","cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:37.864461Z"}]}}