Bug 1620362 (CVE-2018-15494) - CVE-2018-15494 dojo: Cross-site scripting (XSS) due to unescaped strings when editing rows in dojox/Grid/DataGrid
Summary: CVE-2018-15494 dojo: Cross-site scripting (XSS) due to unescaped strings when...
Keywords:
Status: CLOSED WONTFIX
Alias: CVE-2018-15494
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1620363 1620364
Blocks: 1620365
TreeView+ depends on / blocked
 
Reported: 2018-08-23 05:16 UTC by Sam Fowler
Modified: 2021-02-16 23:09 UTC (History)
7 users (show)

Fixed In Version: dojo 1.14
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2019-01-10 08:08:00 UTC
Embargoed:

Attachments (Terms of Use)

Description Sam Fowler 2018-08-23 05:16:35 UTC 
Dojo toolkit before version 1.14 is vulnerable to a cross-site scripting (XSS) due to unescaped strings when editing rows in dojox/Grid/DataGrid.


Upstream Patch:

https://github.com/dojo/dojox/pull/283/commits/e92ee87750af8fbc7e474bb8e8661821aa9f88fa
Comment 1 Sam Fowler 2018-08-23 05:17:01 UTC 
Created dojo tracking bugs for this issue:

Affects: epel-all [bug 1620364]
Affects: fedora-all [bug 1620363]
Comment 2 Cedric Buissart 2018-12-12 10:13:29 UTC 
Statement:

Red Hat Enterprise Satellite 5 is now in Maintenance Support 2 phase of the support and maintenance life cycle. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Satellite 5 Life Cycle: https://access.redhat.com/support/policy/updates/satellite.
Note You need to log in before you can comment on or make changes to this bug.