Prototype pollution in dojox - CVE-2020-5259

Vulnerability identifier: #VU66748

CSH Severity: Medium

CVSS v4 BT: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2020-5259

CWE-ID: CWE-94

Exploitation vector: Remote access

Exploit availability: No public exploit available

The disclosed vulnerability allows a remote attacker to execute arbitrary JavaScript code.

The vulnerability exists due to insufficient sanitization of user-supplied data within the jqMix method. A remote attacker can inject and execute arbitrary JavaScript script code.

dojox
IBM Cloud Pak System
IBM Security Guardium Key Lifecycle Manager (GKLM)
Financial Transaction Manager for ACH Services and Check Services
Financial Transaction Manager for Corporate Payment Services (CPS)
Financial Transaction Manager for Digital Payments (DP)
IBM Sterling B2B Integrator
WebSphere eXtreme Scale
IBM Security Verify Governance
Tivoli Network Manager IP Edition
Financial Transaction Manager for High Value Payments
IBM Storage Scale System
IBM Qradar SIEM

Install update from vendor's website.

dojox - addressed in versions 1.11.10, 1.12.8, 1.13.7, 1.14.6, 1.15.3, 1.16.2
IBM Cloud Pak System - update to 2.3.3.6
IBM Security Guardium Key Lifecycle Manager (GKLM) - update to 4.1.1 FP6
Tivoli Network Manager IP Edition - update to 4.2.0.20
Financial Transaction Manager for ACH Services and Check Services - update to 3.0.5.4 iFix 28
Financial Transaction Manager for Corporate Payment Services (CPS) - update to 3.2.10
Financial Transaction Manager for Digital Payments (DP) - update to 3.2.10
Financial Transaction Manager for High Value Payments - update to 3.2.11
IBM Storage Scale System - addressed in versions 5.1.2.12, 5.1.8
IBM Sterling B2B Integrator - update to 6.1.2.2
IBM Qradar SIEM - addressed in versions 7.4.3 Fix Pack 9, 7.5.0 Update Pack 5
WebSphere eXtreme Scale - update to 8.6.1.6 PH60890 iFix
IBM Security Verify Governance - update to 10.0.2.0.3

• https://github.com/dojo/dojox/commit/47d1b302b5b23d94e875b77b9b9a8c4f5622c9da
• https://github.com/dojo/dojox/security/advisories/GHSA-3hw5-q855-g6cw
• https://lists.debian.org/debian-lts-announce/2020/03/msg00012.html

• Prototype pollution in dojox
• Multiple vulnerabilities in IBM Security Guardium Key Lifecycle Manager
• Multiple vulnerabilities in IBM Sterling B2B Integrator
• Multiple vulnerabilities in IBM Cloud Pak System
• Mulitple vulnerabilities in IBM Storage Scale
• Multiple vulnerabilities in IBM Financial Transaction Manager for Digital Payments, High Value Payments and Corporate Payment Services
• Multiple vulnerabilities in IBM QRadar SIEM
• Multiple vulnerabilities in IBM WebSphere Extreme Scale
• Multiple vulnerabilities in IBM Security Verify Governance
• Multiple vulnerabilities in IBM Tivoli Network Manager IP Edition (ITNM)
• Multiple vulnerabilities in IBM Financial Transaction Manager for ACH Services and Check Services for Multi-Platform