Cross-site scripting in dijit - CVE-2020-4051

Vulnerability identifier: #VU29228

CSH Severity: Low

CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]

CVE-ID: CVE-2020-4051

CWE-ID: CWE-79

Exploitation vector: Remote access

Exploit availability: No public exploit available

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data in the Editor's LinkDialog plugin. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

dijit
IBM Cloud Pak System
IBM Security Guardium Key Lifecycle Manager (GKLM)
Financial Transaction Manager for ACH Services and Check Services
WebSphere eXtreme Scale
IBM Security Verify Governance
Tivoli Network Manager IP Edition
Ubuntu
dojo (Ubuntu package)
Jazz Reporting Service
IBM Cognos Analytics

Install updates from vendor's website.

dijit - addressed in versions 1.11.11, 1.12.9, 1.13.8, 1.14.7, 1.15.4, 1.16.3
IBM Cloud Pak System - update to 2.3.3.6
IBM Security Guardium Key Lifecycle Manager (GKLM) - update to 4.1.1 FP6
Tivoli Network Manager IP Edition - update to 4.2.0.20
dojo (Ubuntu package) - addressed in versions 1.10.4+dfsg-2ubuntu0.1~esm1, 1.15.0+dfsg1-1ubuntu0.1~esm1, 1.15.4+dfsg1-1ubuntu0.1
Financial Transaction Manager for ACH Services and Check Services - update to 3.0.5.4 iFix 28
Jazz Reporting Service - addressed in versions 7.0.2 iFix030, 7.0.3 iFix07
WebSphere eXtreme Scale - update to 8.6.1.6 PH60890 iFix
IBM Security Verify Governance - update to 10.0.2.0.3
IBM Cognos Analytics - addressed in versions 11.1.7.6, 11.2.3

• https://github.com/dojo/dijit/commit/462bdcd60d0333315fe69ab4709c894d78f61301
• https://github.com/dojo/dijit/security/advisories/GHSA-cxjc-r2fp-7mq6

• Cross-site scripting in dijit package
• Multiple vulnerabilities in IBM Security Guardium Key Lifecycle Manager
• Multiple vulnerabilities in IBM Cognos Analytics
• Multiple vulnerabilities in IBM Cloud Pak System
• Multiple vulnerabilities in IBM WebSphere Extreme Scale
• Multiple vulnerabilities in IBM Security Verify Governance
• Cross-site scripting in IBM Jazz Reporting Service
• Multiple vulnerabilities in IBM Tivoli Network Manager IP Edition (ITNM)
• Ubuntu update for dojo
• Multiple vulnerabilities in IBM Financial Transaction Manager for ACH Services and Check Services for Multi-Platform