Vulnerability Details CVE-2010-2274
Multiple open redirect vulnerabilities in Dojo 1.0.x before 1.0.3, 1.1.x before 1.1.2, 1.2.x before 1.2.4, 1.3.x before 1.3.3, and 1.4.x before 1.4.2 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors, possibly related to dojo/resources/iframe_history.html, dojox/av/FLAudio.js, dojox/av/FLVideo.js, dojox/av/resources/audio.swf, dojox/av/resources/video.swf, util/buildscripts/jslib/build.js, util/buildscripts/jslib/buildUtil.js, and util/doh/runner.html.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.007
EPSS Ranking 71.5%
CVSS Severity
CVSS v2 Score 4.3
References
- http://dojotoolkit.org/blog/post/dylan/2010/03/dojo-security-advisory/
- http://secunia.com/advisories/38964
- http://secunia.com/advisories/40007
- http://www-01.ibm.com/support/docview.wss?uid=swg21431472
- http://www-1.ibm.com/support/docview.wss?uid=swg1LO50833
- http://www-1.ibm.com/support/docview.wss?uid=swg1LO50849
- http://www-1.ibm.com/support/docview.wss?uid=swg1LO50856
- http://www-1.ibm.com/support/docview.wss?uid=swg1LO50896
- http://www-1.ibm.com/support/docview.wss?uid=swg1LO50932
- http://www-1.ibm.com/support/docview.wss?uid=swg1LO50958
- http://www-1.ibm.com/support/docview.wss?uid=swg1LO50994
- http://www.vupen.com/english/advisories/2010/1281
- http://dojotoolkit.org/blog/post/dylan/2010/03/dojo-security-advisory/
- http://secunia.com/advisories/38964
- http://secunia.com/advisories/40007
- http://www-01.ibm.com/support/docview.wss?uid=swg21431472
- http://www-1.ibm.com/support/docview.wss?uid=swg1LO50833
- http://www-1.ibm.com/support/docview.wss?uid=swg1LO50849
- http://www-1.ibm.com/support/docview.wss?uid=swg1LO50856
- http://www-1.ibm.com/support/docview.wss?uid=swg1LO50896
- http://www-1.ibm.com/support/docview.wss?uid=swg1LO50932
- http://www-1.ibm.com/support/docview.wss?uid=swg1LO50958
- http://www-1.ibm.com/support/docview.wss?uid=swg1LO50994
- http://www.vupen.com/english/advisories/2010/1281
Products affected by CVE-2010-2274
-
cpe:2.3:a:dojotoolkit:dojo:1.0
-
cpe:2.3:a:dojotoolkit:dojo:1.0.1
-
cpe:2.3:a:dojotoolkit:dojo:1.0.2
-
cpe:2.3:a:dojotoolkit:dojo:1.1
-
cpe:2.3:a:dojotoolkit:dojo:1.1.1
-
cpe:2.3:a:dojotoolkit:dojo:1.2
-
cpe:2.3:a:dojotoolkit:dojo:1.2.1
-
cpe:2.3:a:dojotoolkit:dojo:1.2.2
-
cpe:2.3:a:dojotoolkit:dojo:1.2.3
-
cpe:2.3:a:dojotoolkit:dojo:1.3
-
cpe:2.3:a:dojotoolkit:dojo:1.3.1
-
cpe:2.3:a:dojotoolkit:dojo:1.3.2
-
cpe:2.3:a:dojotoolkit:dojo:1.4
-
cpe:2.3:a:dojotoolkit:dojo:1.4.1