CVE-2018-15494 dojox vulnerable to unescaped string injection
Attackers can inject unescaped strings into Dojo Toolkit DataGrid, potentially leading to cross-site scripting attacks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2018-15494?
CVE-2018-15494 is a critical cross-site scripting vulnerability in Debian Debian Linux, published on 18 Aug 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In Dojo Toolkit before 1.14, there is unescaped string injection in dojox/Grid/DataGrid.
Weakness: CWE-116
Which versions are affected by CVE-2018-15494?
2 open source packages ship an affected version, including dojox. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
dojox npm | All versions | 1.14.0 |
dojox npm | All versions | 1.14.0 |
Products include Debian Debian Linux, Dojotoolkit Dojo.
How do I fix CVE-2018-15494?
Upgrade dojox to 1.14.0 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2018-15494 being exploited?
There is no known exploitation of CVE-2018-15494 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as DEBIAN-CVE-2018-15494, DLA-1492-1, GHSA-84cm-x2q5-8225, UBUNTU-CVE-2018-15494.