CVE-2020-4051: XSS in Dijit Editor's LinkDialog plugin
In Dijit before versions 1.11.11, and greater than or equal to 1.12.0 and less than 1.12.9, and greater than or equal to 1.13.0 and less than 1.13.8, and greater than or equal to 1.14.0 and less than 1.14.7, and greater than or equal to 1.15.0 and less than 1.15.4, and greater than or equal to 1.16.0 and less than 1.16.3, there is a cross-site scripting vulnerability in the Editor's LinkDialog plugin. This has been fixed in 1.11.11, 1.12.9, 1.13.8, 1.14.7, 1.15.4, 1.16.3.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Dijitto a version that resolves this vulnerability.Fixed in 1.11.11 - Upgrade
Upgrade
Dijitto a version that resolves this vulnerability.Fixed in 1.12.9 - Upgrade
Upgrade
Dijitto a version that resolves this vulnerability.Fixed in 1.13.8 - Upgrade
Upgrade
Dijitto a version that resolves this vulnerability.Fixed in 1.14.7 - Upgrade
Upgrade
Dijitto a version that resolves this vulnerability.Fixed in 1.15.4 - Upgrade
Upgrade
Dijitto a version that resolves this vulnerability.Fixed in 1.16.3
Event History
Frequently Asked Questions
What is the vulnerability ID of this security issue?
The vulnerability ID of this security issue is CVE-2020-4051.
What is the severity rating of CVE-2020-4051?
The severity rating of CVE-2020-4051 is medium.
Which software versions are affected by CVE-2020-4051?
IBM Cognos Analytics 11.2.x and IBM Cognos Analytics 11.1.x are affected by CVE-2020-4051.
How can I fix CVE-2020-4051?
Update Dijit to versions 1.11.11, 1.12.9, 1.13.8, 1.14.7, 1.15.4, or 1.16.3 to fix CVE-2020-4051.
Which Common Weakness Enumeration (CWE) is associated with CVE-2020-4051?
CVE-2020-4051 is associated with CWE-79 (Improper Neutralization of Input During Web Page Generation).