CVE-2020-4051 XSS in Dijit Editor's LinkDialog plugin
Cross-site scripting in Dijit Editor's LinkDialog plugin allows attackers to execute arbitrary scripts in user browsers.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2020-4051?
CVE-2020-4051 is a low-severity cross-site scripting vulnerability in Debian Debian Linux, published on 15 Jun 2020. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
In Dijit before versions 1.11.11, and greater than or equal to 1.12.0 and less than 1.12.9, and greater than or equal to 1.13.0 and less than 1.13.8, and greater than or equal to 1.14.0 and less than 1.14.7, and greater than or equal to 1.15.0 and less than 1.15.4, and greater than or equal to 1.16.0 and less than 1.16.3, there is a cross-site scripting vulnerability in the Editor's LinkDialog plugin. This has been fixed in 1.11.11, 1.12.9, 1.13.8, 1.14.7, 1.15.4, 1.16.3.
Weakness: CWE-79
Which versions are affected by CVE-2020-4051?
12 open source packages ship an affected version, including dijit. It affects 6 products.
| Package | Affected | Fixed in |
|---|---|---|
dijit npm | All versions | 1.11.11 |
dijit npm | All versions | 1.11.11 |
dijit npm | From 1.12.0 | 1.12.9 |
dijit npm | From 1.12.0 | 1.12.9 |
dijit npm | From 1.13.0 | 1.13.8 |
dijit npm | From 1.13.0 | 1.13.8 |
6 more packages
dijit npm | From 1.14.0 | 1.14.7 |
dijit npm | From 1.14.0 | 1.14.7 |
dijit npm | From 1.15.0 | 1.15.4 |
dijit npm | From 1.15.0 | 1.15.4 |
dijit npm | From 1.16.0 | 1.16.3 |
dijit npm | From 1.16.0 | 1.16.3 |
Products include Debian Debian Linux, Netapp Active Iq Unified Manager, Netapp Oncommand Insight, Netapp Oncommand Workflow Automation, Netapp Snapcenter, Openjsf Dijit.
How do I fix CVE-2020-4051?
Upgrade dijit to a fixed version for your release line: 1.11.11, 1.12.9, 1.13.8 or 1.14.7.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2020-4051 being exploited?
There is no known exploitation of CVE-2020-4051 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as DEBIAN-CVE-2020-4051, GHSA-cxjc-r2fp-7mq6, UBUNTU-CVE-2020-4051.