RCE in Dojo Dojox
CVE-2020-5259
In affected versions of dojox (NPM package), the jqMix method is vulnerable to Prototype Pollution. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. This has been patched in versions 1.11.10, 1.12.8, 1.13.7, 1.14.6, 1.15.3 and 1.16.2
Vulnerability class: RCE (Remote Code Execution)
EPSS: 0.020 (78.7th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.7 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N.
Affected products
- Dojo Dojox — versions < 1.11.10, >= 1.12.0, < 1.12.8, >= 1.13.0, < 1.13.7
- Linuxfoundation Dojox
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM, Exploit, Third Party Advisory)
- security-advisories@github.com (Patch, x_refsource_MISC)
- security-advisories@github.com (mailing-list, x_refsource_MLIST)
Frequently asked questions
- What is CVE-2020-5259?
- CVE-2020-5259 is a high-severity vulnerability in Dojo Dojox, classified under Code Injection. CVSS score: 7.7/10. Published 2020-03-10.
- How severe is CVE-2020-5259?
- High severity. CVSS v3 base score is 7.7 out of 10.