{"id":"CVE-2020-4051","aliases":["DEBIAN-CVE-2020-4051","DLA-3289-1","EUVD-2020-0482","GHSA-cxjc-r2fp-7mq6","MGASA-2023-0039","UBUNTU-CVE-2020-4051","USN-7569-1"],"status":"published","title":"XSS in Dijit Editor's LinkDialog plugin","description":"In Dijit before versions 1.11.11, and greater than or equal to 1.12.0 and less than 1.12.9, and greater than or equal to 1.13.0 and less than 1.13.8, and greater than or equal to 1.14.0 and less than 1.14.7, and greater than or equal to 1.15.0 and less than 1.15.4, and greater than or equal to 1.16.0 and less than 1.16.3, there is a cross-site scripting vulnerability in the Editor's LinkDialog plugin. This has been fixed in 1.11.11, 1.12.9, 1.13.8, 1.14.7, 1.15.4, 1.16.3.","severity":{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.01177,"percentile":0.67863,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2020-06-15T00:00:00Z","modified":"2026-10-26T12:02:49Z","fixes":[{"ecosystem":"npm","package":"dijit","fixed_in":["1.11.11","1.12.9","1.13.8","1.14.7","1.15.4","1.16.3"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"dojo","fixed_in":["1.15.4+dfsg1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"dojo","fixed_in":["1.15.4+dfsg1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"dojo","fixed_in":["1.15.4+dfsg1-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"dojo","fixed_in":["1.10.4+dfsg-2ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"dojo","fixed_in":["1.15.0+dfsg1-1ubuntu0.1~esm1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"dijit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.11"}]}]},{"source":"ghsa","ecosystem":"npm","package":"dijit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.12.0"},{"fixed":"1.12.9"}]}]},{"source":"ghsa","ecosystem":"npm","package":"dijit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.13.0"},{"fixed":"1.13.8"}]}]},{"source":"ghsa","ecosystem":"npm","package":"dijit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.14.0"},{"fixed":"1.14.7"}]}]},{"source":"ghsa","ecosystem":"npm","package":"dijit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.15.0"},{"fixed":"1.15.4"}]}]},{"source":"ghsa","ecosystem":"npm","package":"dijit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.16.0"},{"fixed":"1.16.3"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"dojo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.4+dfsg1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"dojo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.4+dfsg1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"dojo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.4+dfsg1-1"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"dojo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.2+dfsg1-1+deb10u3"}]}],"versions":["1.14.2+dfsg1-1","1.14.2+dfsg1-1+deb10u1","1.14.2+dfsg1-1+deb10u2"],"bundled":2},{"source":"osv","ecosystem":"npm","package":"dijit","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.11.11"}]}]},{"source":"osv","ecosystem":"npm","package":"dijit","ranges":[{"type":"SEMVER","events":[{"introduced":"1.12.0"},{"fixed":"1.12.9"}]}]},{"source":"osv","ecosystem":"npm","package":"dijit","ranges":[{"type":"SEMVER","events":[{"introduced":"1.13.0"},{"fixed":"1.13.8"}]}]},{"source":"osv","ecosystem":"npm","package":"dijit","ranges":[{"type":"SEMVER","events":[{"introduced":"1.14.0"},{"fixed":"1.14.7"}]}]},{"source":"osv","ecosystem":"npm","package":"dijit","ranges":[{"type":"SEMVER","events":[{"introduced":"1.15.0"},{"fixed":"1.15.4"}]}]},{"source":"osv","ecosystem":"npm","package":"dijit","ranges":[{"type":"SEMVER","events":[{"introduced":"1.16.0"},{"fixed":"1.16.3"}]}]},{"source":"osv","ecosystem":"Mageia:8","package":"dojo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.5-1.mga8"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"dojo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.4+dfsg-2ubuntu0.1~esm1"}]}],"versions":["1.10.4+dfsg-2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"dojo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.11.0+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"dojo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.0+dfsg1-1ubuntu0.1~esm1"}]}],"versions":["1.14.2+dfsg1-1","1.15.0+dfsg1-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"dojo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.4+dfsg-2ubuntu0.1~esm1"}]}],"versions":["1.10.4+dfsg-2"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"dojo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.0+dfsg1-1ubuntu0.1~esm1"}]}],"versions":["1.14.2+dfsg1-1","1.15.0+dfsg1-1"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"dojo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.4+dfsg1-1ubuntu0.1"}]}],"versions":["1.15.4+dfsg1-1"],"bundled":4}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"dojo","product":"dijit"},{"vendor":"netapp","product":"active_iq_unified_manager"},{"vendor":"netapp","product":"oncommand_insight"},{"vendor":"netapp","product":"oncommand_workflow_automation"},{"vendor":"netapp","product":"snapcenter"},{"vendor":"openjsf","product":"dijit"}],"references":[{"url":"https://github.com/dojo/dijit/security/advisories/GHSA-cxjc-r2fp-7mq6","tags":["x_transferred","Third Party Advisory","advisory","web","report"]},{"url":"https://github.com/dojo/dijit/commit/462bdcd60d0333315fe69ab4709c894d78f61301","tags":["x_transferred","Patch","Third Party Advisory","fix","web","report"]},{"url":"https://www.oracle.com/security-alerts/cpuoct2020.html","tags":["x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://security.netapp.com/advisory/ntap-20201023-0003/","tags":["x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/01/msg00030.html","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-4051","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-cxjc-r2fp-7mq6"},{"url":"https://security-tracker.debian.org/tracker/CVE-2020-4051","tags":["advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20201023-0003","tags":["web"]},{"url":"https://advisories.mageia.org/MGASA-2023-0039.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=31491","tags":["report"]},{"url":"https://github.com/advisories/GHSA-m8gw-hjpr-rjv7","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2020-4051","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-4051","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7569-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2018-15494","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-10785","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-23450","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2020-4051","title":"XSS in Dijit Editor's LinkDialog plugin","description":"In Dijit before versions 1.11.11, and greater than or equal to 1.12.0 and less than 1.12.9, and greater than or equal to 1.13.0 and less than 1.13.8, and greater than or equal to 1.14.0 and less than 1.14.7, and greater than or equal to 1.15.0 and less than 1.15.4, and greater than or equal to 1.16.0 and less than 1.16.3, there is a cross-site scripting vulnerability in the Editor's LinkDialog plugin. This has been fixed in 1.11.11, 1.12.9, 1.13.8, 1.14.7, 1.15.4, 1.16.3.","status":"published","published":"2020-06-15T00:00:00Z","modified":"2024-08-04T07:52:20.806Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N","level":"low","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:35:55.797746Z"}],"euvd":[{"id":"EUVD-2020-0482","description":"In Dijit before versions 1.11.11, and greater than or equal to 1.12.0 and less than 1.12.9, and greater than or equal to 1.13.0 and less than 1.13.8, and greater than or equal to 1.14.0 and less than 1.14.7, and greater than or equal to 1.15.0 and less than 1.15.4, and greater than or equal to 1.16.0 and less than 1.16.3, there is a cross-site scripting vulnerability in the Editor's LinkDialog plugin. This has been fixed in 1.11.11, 1.12.9, 1.13.8, 1.14.7, 1.15.4, 1.16.3.","status":"published","published":"2020-06-15T00:00:00Z","modified":"2024-08-04T07:52:20Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N","level":"low"}],"updated_at":"2026-11-03T03:08:08.458165Z"}],"ghsa":[{"id":"GHSA-cxjc-r2fp-7mq6","title":"Cross-site Scripting in dijit editor's LinkDialog plugin ","description":"### Impact\nXSS possible for users of the Dijit Editor's LinkDialog plugin\n\n### Patches\nYes, 1.11.11, 1.12.9, 1.13.8, 1.14.7, 1.15.4, 1.16.3\n\n### Workarounds\nUsers may apply the patch made in these releases.\n\n\n### For more information\nIf you have any questions or comments about this advisory, open an issue in [dojo/dijit](https://github.com/dojo/dijit/)","status":"published","published":"2020-06-15T21:53:12Z","modified":"2023-03-01T01:09:27Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N","level":"low"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:36:46.526285Z"}],"nvd":[{"id":"CVE-2020-4051","description":"In Dijit before versions 1.11.11, and greater than or equal to 1.12.0 and less than 1.12.9, and greater than or equal to 1.13.0 and less than 1.13.8, and greater than or equal to 1.14.0 and less than 1.14.7, and greater than or equal to 1.15.0 and less than 1.15.4, and greater than or equal to 1.16.0 and less than 1.16.3, there is a cross-site scripting vulnerability in the Editor's LinkDialog plugin. This has been fixed in 1.11.11, 1.12.9, 1.13.8, 1.14.7, 1.15.4, 1.16.3.","status":"published","published":"2020-06-15T22:15:09.973Z","modified":"2026-06-17T03:19:29.72Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N","level":"low","assessor":"secondary"},{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":3.5,"vector":"AV:N/AC:M/Au:S/C:N/I:P/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:06:07.249892Z"}],"osv":[{"id":"CVE-2020-4051","description":"In Dijit before versions 1.11.11, and greater than or equal to 1.12.0 and less than 1.12.9, and greater than or equal to 1.13.0 and less than 1.13.8, and greater than or equal to 1.14.0 and less than 1.14.7, and greater than or equal to 1.15.0 and less than 1.15.4, and greater than or equal to 1.16.0 and less than 1.16.3, there is a cross-site scripting vulnerability in the Editor's LinkDialog plugin. This has been fixed in 1.11.11, 1.12.9, 1.13.8, 1.14.7, 1.15.4, 1.16.3.","status":"published","published":"2020-06-15T22:15:09.973Z","modified":"2026-10-20T10:53:28.68059645Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:16.936975Z"},{"id":"DEBIAN-CVE-2020-4051","description":"In Dijit before versions 1.11.11, and greater than or equal to 1.12.0 and less than 1.12.9, and greater than or equal to 1.13.0 and less than 1.13.8, and greater than or equal to 1.14.0 and less than 1.14.7, and greater than or equal to 1.15.0 and less than 1.15.4, and greater than or equal to 1.16.0 and less than 1.16.3, there is a cross-site scripting vulnerability in the Editor's LinkDialog plugin. This has been fixed in 1.11.11, 1.12.9, 1.13.8, 1.14.7, 1.15.4, 1.16.3.","status":"published","published":"2020-06-15T22:15:09.973Z","modified":"2026-10-26T12:02:49.680433951Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:34.019707Z"},{"id":"GHSA-cxjc-r2fp-7mq6","title":"Cross-site Scripting in dijit editor's LinkDialog plugin ","description":"### Impact\nXSS possible for users of the Dijit Editor's LinkDialog plugin\n\n### Patches\nYes, 1.11.11, 1.12.9, 1.13.8, 1.14.7, 1.15.4, 1.16.3\n\n### Workarounds\nUsers may apply the patch made in these releases.\n\n\n### For more information\nIf you have any questions or comments about this advisory, open an issue in [dojo/dijit](https://github.com/dojo/dijit/)","status":"published","published":"2020-06-15T21:53:12Z","modified":"2026-07-08T05:59:44.003298442Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N","level":"low"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:45.639885Z"},{"id":"UBUNTU-CVE-2020-4051","description":"In Dijit before versions 1.11.11, and greater than or equal to 1.12.0 and less than 1.12.9, and greater than or equal to 1.13.0 and less than 1.13.8, and greater than or equal to 1.14.0 and less than 1.14.7, and greater than or equal to 1.15.0 and less than 1.15.4, and greater than or equal to 1.16.0 and less than 1.16.3, there is a cross-site scripting vulnerability in the Editor's LinkDialog plugin. This has been fixed in 1.11.11, 1.12.9, 1.13.8, 1.14.7, 1.15.4, 1.16.3.","status":"published","published":"2020-06-15T22:15:00Z","modified":"2026-02-04T03:51:09.61044Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N","level":"low"},{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:25.179924Z"},{"id":"DLA-3289-1","title":"dojo - security update","status":"published","published":"2023-01-28T00:00:00Z","modified":"2026-03-09T01:18:50.405276Z","updated_at":"2026-11-02T15:46:11.734021Z"},{"id":"MGASA-2023-0039","title":"Updated dojo packages fix security vulnerability","description":"Dijit Editor's LinkDialog plugin of dojo 1.14.0 to 1.14.7 is vulnerable to\ncross-site scripting (XSS) attacks. (CVE-2020-4051)\nPrototype pollution vulnerability via the setObject() function.\n(CVE-2021-23450)\n","status":"published","published":"2023-02-07T00:06:39Z","modified":"2026-04-16T04:40:51.964049674Z","updated_at":"2026-11-02T15:49:42.263076Z"},{"id":"USN-7569-1","title":"dojo vulnerabilities","description":"It was discovered that Dojo did not correctly handle DataGrids. An\nattacker could possibly use this issue to execute arbitrary code. This\nissue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. \n(CVE-2018-15494)\n\nIt was discovered that Dojo was vulnerable to prototype pollution. An\nattacker could possibly use this issue to execute arbitrary code.\n(CVE-2021-23450)\n\nJonathan Leitschuh discovered that Dojo did not correctly sanitize\ncertain inputs. An attacker could possibly use this issue to execute a\ncross-site scripting (XSS) attack. This issue only affected\nUbuntu 16.04 LTS, Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. \n(CVE-2019-10785, CVE-2020-4051)","status":"published","published":"2025-06-16T02:55:56Z","modified":"2026-06-25T13:32:30.502422472Z","updated_at":"2026-11-02T16:58:19.988474Z"}]}}