dojo/dojox · Security
dojox vulnerable to unescaped string injection
- GHSA ID
- GHSA-84cm-x2q5-8225
- CVE ID
- CVE-2018-15494
- Severity
- critical
- Published
- Updated
- CVSS
- 9.8 · CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS v3
- 9.8 · CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Description
In Dojo Toolkit before 1.14.0, there is unescaped string injection in dojox/Grid/DataGrid.
CWEs
- CWE-116 · Improper Encoding or Escaping of Output