CVE-2020-5259: Prototype Pollution in Dojox
First published: Tue Mar 10 2020(Updated: )
Dojo dojox could allow a remote attacker to inject arbitrary code on the system, caused by a prototype pollution flaw. By injecting other values, an attacker could exploit this vulnerability to overwrite, or pollute, a JavaScript application object prototype of the base object.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Linuxfoundation Dojox | <1.11.10 | |
| Linuxfoundation Dojox | >=1.12.0<1.12.8 | |
| Linuxfoundation Dojox | >=1.13.0<1.13.7 | |
| Linuxfoundation Dojox | >=1.14.0<1.14.6 | |
| Linuxfoundation Dojox | >=1.15.0<1.15.3 | |
| Linuxfoundation Dojox | >=1.16.0<1.16.2 | |
| IBM Financial Transaction Manager for Corporate Payment Services for Multi-Platform | <=3.2.0-3.2.9 | |
| IBM Financial Transaction Manager for Digital Payments for Multi-Platform | <=3.2.0-3.2.9 | |
| IBM Financial Transaction Manager for High Value Payments for Multi-Platform | <=3.2.0-3.2.10.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/dojo/dojox/commit/47d1b302b5b23d94e875b77b9b9a8c4f5622c9da
- https://github.com/dojo/dojox/security/advisories/GHSA-3hw5-q855-g6cw
- https://lists.debian.org/debian-lts-announce/2020/03/msg00012.html
- https://exchange.xforce.ibmcloud.com/vulnerabilities/177752
- https://www.ibm.com/support/pages/node/6962117 (Advisory)
- agent/type
- agent/weakness
- agent/remedy
- agent/author
- agent/description
- collector/nvd-index
- agent/software-canonical-lookup-request
- collector/ibm-support
- source/IBM
- agent/software-canonical-lookup
- agent/references
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/title
- agent/severity
- agent/last-modified-date
- agent/first-publish-date
- agent/event
- agent/tags
- agent/trending
- vendor/linuxfoundation
- canonical/linuxfoundation dojox
- version/linuxfoundation dojox/1.12.0
- version/linuxfoundation dojox/1.13.0
- version/linuxfoundation dojox/1.14.0
- version/linuxfoundation dojox/1.15.0
- version/linuxfoundation dojox/1.16.0
- vendor/ibm
- canonical/ibm financial transaction manager for corporate payment services for multi-platform
- version/ibm financial transaction manager for corporate payment services for multi-platform/3.2.0-3.2.9
- canonical/ibm financial transaction manager for digital payments for multi-platform
- version/ibm financial transaction manager for digital payments for multi-platform/3.2.0-3.2.9
- canonical/ibm financial transaction manager for high value payments for multi-platform
- version/ibm financial transaction manager for high value payments for multi-platform/3.2.0-3.2.10.2