CVE-2020-4051

MEDIUM EPSS 63.9%

Published Jun 15, 20206y ago · Modified Jun 17, 20262w ago

5.4 CVSS 3.1

Medium

Published Jun 15, 2020 6y ago

Last Modified Jun 17, 2026 2w ago

Description

In Dijit before versions 1.11.11, and greater than or equal to 1.12.0 and less than 1.12.9, and greater than or equal to 1.13.0 and less than 1.13.8, and greater than or equal to 1.14.0 and less than 1.14.7, and greater than or equal to 1.15.0 and less than 1.15.4, and greater than or equal to 1.16.0 and less than 1.16.3, there is a cross-site scripting vulnerability in the Editor's LinkDialog plugin. This has been fixed in 1.11.11, 1.12.9, 1.13.8, 1.14.7, 1.15.4, 1.16.3.

CVSS Details

Base Score

5.4

Exploitability

2.3

Impact

2.7

Vector string

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Attack Vector Network

Attack Complexity Low

Privileges Required Low

User Interaction Required

Scope Changed

Confidentiality Low

Integrity Low

Availability None

Threat Intelligence

EPSS Exploit Probability

63.9% percentile

Exploit & Patch Status

No Known Exploit

Patch Available

Weaknesses 1

CWE-79 Cross-site Scripting Injection

Affected Products 12

Vendor	Product	Version	Range
openjsf	dijit	*	<1.11.11
openjsf	dijit	*	≥1.12.0 – <1.12.9
openjsf	dijit	*	≥1.13.0 – <1.13.8
openjsf	dijit	*	≥1.14.0 – <1.14.7
openjsf	dijit	*	≥1.15.0 – <1.15.4
openjsf	dijit	*	≥1.16.0 – <1.16.3
debian	debian_linux	10.0	any
netapp	active_iq_unified_manager	*	any
netapp	active_iq_unified_manager	*	any
netapp	oncommand_insight	*	any
netapp	oncommand_workflow_automation	*	any
netapp	snapcenter	*	any

References 5

github.com https://github.com/dojo/dijit/commit/462bdcd60d0333315fe69ab4709c894d78f61301

PatchThird Party Advisory
github.com https://github.com/dojo/dijit/security/advisories/GHSA-cxjc-r2fp-7mq6

Third Party Advisory
lists.debian.org https://lists.debian.org/debian-lts-announce/2023/01/msg00030.html

Mailing ListThird Party Advisory
security.netapp.com https://security.netapp.com/advisory/ntap-20201023-0003/

Third Party Advisory
oracle.com https://www.oracle.com/security-alerts/cpuoct2020.html

PatchThird Party Advisory

Remediation

github.com https://github.com/dojo/dijit/commit/462bdcd60d0333315fe69ab4709c894d78f61301

PatchThird Party Advisory
oracle.com https://www.oracle.com/security-alerts/cpuoct2020.html

PatchThird Party Advisory