XSS in dojox due to insufficient escape in dojox.xmpp.util.xmlEncode

Description

Potential XSS vulnerability for users of dojox/xmpp and dojox/dtl.

Recommendation

Update the dojox package to the latest compatible version. Followings are version details:

• Affected version(s): **= 1.16.0

  >= 1.15.0, < 1.15.2

  >= 1.14.0, < 1.14.5

  >= 1.13.0, < 1.13.6

  >= 1.12.0, < 1.12.7

  < 1.11.9**

• Patched version(s): **1.16.1

  1.15.2

  1.14.5

  1.13.6

  1.12.7

  1.11.9**

References

• GHSA-pg97-ww7h-5mjr
• snyk.io
• lists.debian.org
• CVE-2019-10785
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• materialize-css vulnerable to cross-site Scripting (XSS) due to improper escape of user input - CVE-2022-25349
• Insufficient Verification of Data Authenticity in Eclipse Theia - CVE-2019-17636
• Pannellum Cross-Site Scripting due to data not being sanitized for URIs or vbscript - CVE-2019-16763
• sanitize-html is vulnerable to XSS through incomprehensive sanitization - CVE-2019-25225

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How do hackers hack websites?

CSRF, XXE, and 12 Other Security Acronyms Explained

Tags:

npm

dojox