CVE-2019-10785: debian debian_linux Cross-site Scripting
CVSS: 6.1v3.1MediumModified
AliasesMGASA-2020-0126UBUNTU-CVE-2019-10785DEBIAN-CVE-2019-10785DLA-2127-1GHSA-pg97-ww7h-5mjrSNYK-JS-DOJOX-548257
Published 13-02-2020Last modified 04-08-2024
Vulnerability summary
CVE-2019-10785 is a medium (CVSS 6.1) Cross-site Scripting vulnerability in debian debian_linux. EPSS estimates a 1.85% chance of exploitation in the next 30 days, higher than 78.6% of scored vulnerabilities. 1 public exploit is recorded.
CVSS score
6.1/10
010
Medium · v3.1 (NVD)EPSS score
1.85%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1github
Advisory lineage
Upstream 0 · Downstream 1 · Related 1Timeline
- 13-02-2020PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
dojox is vulnerable to Cross-site Scripting in all versions before version 1.16.1, 1.15.2, 1.14.5, 1.13.6, 1.12.7 and 1.11.9. This is due to dojox.xmpp.util.xmlEncode only encoding the first occurrence of each character, not all of them.
CVSS metrics
5 scores · 4 sources · 2 versionsMedium 6.1Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NSourcesAll 4 agree
- OSV · UbuntuEcosystem advisory · calculated6.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- OSV · DebianEcosystem advisory · calculated6.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- OSV · NpmEcosystem advisory · calculated6.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Medium 4.3Preferred score · NVD (NIST)
AV:N/AC:M/Au:N/C:N/I:P/A:NSourcesSingle source
EPSS trend
Probability
1.85%
Chance of exploitation in the next 30 days
Percentile
79%
Versus all other CVEs
30-day change
0.00 pp
From 1.85% on 18-09-2026
18-09-202618-10-2026
EPSS score1.85%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundDojox
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Debian2 products
- dojo< 1.15.2+dfsg1-1 | < 1.10.2+dfsg-1+deb8u2
- debian_linuxEOL8.0
Linuxfoundation1 product
- dojox≥ 1.11.0, < 1.11.9 | ≥ 1.12.0, < 1.12.7 | ≥ 1.13.0, < 1.13.6 | ≥ 1.14.0, < 1.14.5 | ≥ 1.15.0, < 1.15.2 | ≥ 1.16.0, < 1.16.1
Mageia1 product
- dojo< 1.14.5-1.mga7
Npm1 product
- dojox< 1.11.9 | ≥ 1.12.0, < 1.12.7 | ≥ 1.13.0, < 1.13.6 | ≥ 1.14.0, < 1.14.5 | ≥ 1.15.0, < 1.15.2 | ≥ 1.16.0, < 1.16.1
Ubuntu1 product
- dojo< 1.10.4+dfsg-2ubuntu0.1~esm1 | All versions (No fix recorded) | < 1.15.0+dfsg1-1ubuntu0.1~esm1
5 vendors · 6 products
References
15 links- snyk.io/vuln/SNYK-JS-DOJOX-548257%2CX Refsource MISC
- github.com/dojo/dojox/security/advisories/GHSA-pg97-ww7h-5mjrX Refsource MISCExploitThird Party AdvisoryREPORTWEB
lists.debian.org/debian-lts-announce/2020/02/msg00033.htmlMailing ListX Refsource MLISTThird Party AdvisoryWEB
