CVE-2010-2274
First published: Mon Jun 14 2010(Updated: )
Multiple open redirect vulnerabilities in Dojo 1.0.x before 1.0.3, 1.1.x before 1.1.2, 1.2.x before 1.2.4, 1.3.x before 1.3.3, and 1.4.x before 1.4.2 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors, possibly related to dojo/resources/iframe_history.html, dojox/av/FLAudio.js, dojox/av/FLVideo.js, dojox/av/resources/audio.swf, dojox/av/resources/video.swf, util/buildscripts/jslib/build.js, util/buildscripts/jslib/buildUtil.js, and util/doh/runner.html.
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| maven/org.dojotoolkit:dojo | >=1.4.0<1.4.2 | 1.4.2 |
| maven/org.dojotoolkit:dojo | >=1.3.0<1.3.3 | 1.3.3 |
| maven/org.dojotoolkit:dojo | >=1.2.0<1.2.4 | 1.2.4 |
| maven/org.dojotoolkit:dojo | >=1.1.0<1.1.2 | 1.1.2 |
| maven/org.dojotoolkit:dojo | >=1.0.0<1.0.3 | 1.0.3 |
| Dojo Toolkit | =1.0 | |
| Dojo Toolkit | =1.0.1 | |
| Dojo Toolkit | =1.0.2 | |
| Dojo Toolkit | =1.1 | |
| Dojo Toolkit | =1.1.1 | |
| Dojo Toolkit | =1.2 | |
| Dojo Toolkit | =1.2.1 | |
| Dojo Toolkit | =1.2.2 | |
| Dojo Toolkit | =1.2.3 | |
| Dojo Toolkit | =1.3 | |
| Dojo Toolkit | =1.3.1 | |
| Dojo Toolkit | =1.3.2 | |
| Dojo Toolkit | =1.4 | |
| Dojo Toolkit | =1.4.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www-1.ibm.com/support/docview.wss?uid=swg1LO50856
- http://secunia.com/advisories/38964
- http://www-01.ibm.com/support/docview.wss?uid=swg21431472
- http://secunia.com/advisories/40007
- http://www-1.ibm.com/support/docview.wss?uid=swg1LO50958
- http://www.vupen.com/english/advisories/2010/1281
- http://www-1.ibm.com/support/docview.wss?uid=swg1LO50932
- http://www-1.ibm.com/support/docview.wss?uid=swg1LO50994
- http://dojotoolkit.org/blog/post/dylan/2010/03/dojo-security-advisory/
- http://www-1.ibm.com/support/docview.wss?uid=swg1LO50896
- http://www-1.ibm.com/support/docview.wss?uid=swg1LO50849
- http://www-1.ibm.com/support/docview.wss?uid=swg1LO50833
- https://nvd.nist.gov/vuln/detail/CVE-2010-2274
- https://web.archive.org/web/20100617172214/http://secunia.com/advisories/40007
- https://web.archive.org/web/20100629020444/http://secunia.com/advisories/38964
- https://github.com/advisories/GHSA-mmjh-45vj-hfvf (Advisory)
Frequently Asked Questions
What is the severity of CVE-2010-2274?
CVE-2010-2274 has a medium severity level as it allows for open redirects, which can lead to phishing attacks.
How do I fix CVE-2010-2274?
To resolve CVE-2010-2274, upgrade to Dojo Toolkit version 1.0.3 or later, specifically 1.4.2 or above.
What versions of Dojo are affected by CVE-2010-2274?
CVE-2010-2274 affects Dojo versions 1.0.x before 1.0.3, 1.1.x before 1.1.2, 1.2.x before 1.2.4, 1.3.x before 1.3.3, and 1.4.x before 1.4.2.
Can CVE-2010-2274 be exploited remotely?
Yes, CVE-2010-2274 can be exploited remotely by attackers to redirect users to arbitrary websites.
What should I do if I can't upgrade from Dojo due to compatibility issues with CVE-2010-2274?
If upgrading is not feasible, consider implementing URL validation and additional security measures to mitigate the risks associated with CVE-2010-2274.
- agent/type
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-mmjh-45vj-hfvf
- alias/CVE-2010-2274
- agent/software-canonical-lookup
- agent/remedy
- agent/severity
- agent/references
- agent/weakness
- agent/description
- agent/author
- collector/github-advisory
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/first-publish-date
- agent/event
- agent/trending
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- collector/nvd-cve
- source/NVD
- collector/nvd-historical
- package-manager/maven
- vendor/dojotoolkit
- canonical/dojo toolkit
- version/dojo toolkit/1.0
- version/dojo toolkit/1.0.1
- version/dojo toolkit/1.0.2
- version/dojo toolkit/1.1
- version/dojo toolkit/1.1.1
- version/dojo toolkit/1.2
- version/dojo toolkit/1.2.1
- version/dojo toolkit/1.2.2
- version/dojo toolkit/1.2.3
- version/dojo toolkit/1.3
- version/dojo toolkit/1.3.1
- version/dojo toolkit/1.3.2
- version/dojo toolkit/1.4
- version/dojo toolkit/1.4.1