Vulnerability Details : CVE-2020-4051
In Dijit before versions 1.11.11, and greater than or equal to 1.12.0 and less than 1.12.9, and greater than or equal to 1.13.0 and less than 1.13.8, and greater than or equal to 1.14.0 and less than 1.14.7, and greater than or equal to 1.15.0 and less than 1.15.4, and greater than or equal to 1.16.0 and less than 1.16.3, there is a cross-site scripting vulnerability in the Editor's LinkDialog plugin. This has been fixed in 1.11.11, 1.12.9, 1.13.8, 1.14.7, 1.15.4, 1.16.3.
Vulnerability category: Cross site scripting (XSS)
Products affected by CVE-2020-4051
- cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
- cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:*
- cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:*
- cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:*
- cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*
- cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:*
- cpe:2.3:a:openjsf:dijit:*:*:*:*:*:*:*:*
- cpe:2.3:a:openjsf:dijit:*:*:*:*:*:*:*:*
- cpe:2.3:a:openjsf:dijit:*:*:*:*:*:*:*:*
- cpe:2.3:a:openjsf:dijit:*:*:*:*:*:*:*:*
- cpe:2.3:a:openjsf:dijit:*:*:*:*:*:*:*:*
- cpe:2.3:a:openjsf:dijit:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2020-4051
0.36%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 68 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2020-4051
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
3.5
|
LOW | AV:N/AC:M/Au:S/C:N/I:P/A:N |
6.8
|
2.9
|
NIST | |
|
5.4
|
MEDIUM | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
2.3
|
2.7
|
NIST | |
|
3.7
|
LOW | CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N |
1.2
|
2.5
|
GitHub, Inc. |
CWE ids for CVE-2020-4051
-
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.Assigned by: security-advisories@github.com (Primary)
References for CVE-2020-4051
-
https://security.netapp.com/advisory/ntap-20201023-0003/
October 2020 MySQL Vulnerabilities in NetApp Products | NetApp Product SecurityThird Party Advisory
-
https://www.oracle.com/security-alerts/cpuoct2020.html
Oracle Critical Patch Update Advisory - October 2020Patch;Third Party Advisory
-
https://github.com/dojo/dijit/commit/462bdcd60d0333315fe69ab4709c894d78f61301
Merge pull request from GHSA-cxjc-r2fp-7mq6 · dojo/dijit@462bdcd · GitHubPatch;Third Party Advisory
-
https://lists.debian.org/debian-lts-announce/2023/01/msg00030.html
[SECURITY] [DLA 3289-1] dojo security updateMailing List;Third Party Advisory
-
https://github.com/dojo/dijit/security/advisories/GHSA-cxjc-r2fp-7mq6
XSS in dijit/editor · Advisory · dojo/dijit · GitHubThird Party Advisory
Jump to