GHSA-3hw5-q855-g6cwLowCVSS 7.7
Prototype Pollution in Dojox
🔗 CVE IDs covered (1)
📋 Description
The Dojox jQuery wrapper jqMix mixin method is vulnerable to Prototype Pollution.
Affected Area:
//https://github.com/dojo/dojox/blob/master/jq.js#L442
var tobj = {};
for(var x in props){
// the "tobj" condition avoid copying properties in "props"
// inherited from Object.prototype. For example, if obj has a custom
// toString() method, don't overwrite it with the toString() method
// that props inherited from Object.prototype
if((tobj[x] === undefined || tobj[x] != props[x]) && props[x] !== undefined && obj != props[x]){
if(dojo.isObject(obj[x]) && dojo.isObject(props[x])){
if(dojo.isArray(props[x])){
obj[x] = props[x];
}else{
obj[x] = jqMix(obj[x], props[x]);
}
}else{
obj[x] = props[x];
}
🎯 Affected products6
- npm/dojox:< 1.11.10
- npm/dojox:>= 1.12.0, < 1.12.8
- npm/dojox:>= 1.13.0, < 1.13.7
- npm/dojox:>= 1.14.0, < 1.14.6
- npm/dojox:>= 1.15.0, < 1.15.3
- npm/dojox:>= 1.16.0, < 1.16.2
🔗 References (5)
- https://github.com/dojo/dojox/security/advisories/GHSA-3hw5-q855-g6cw
- https://github.com/dojo/dojox/commit/47d1b302b5b23d94e875b77b9b9a8c4f5622c9da
- https://nvd.nist.gov/vuln/detail/CVE-2020-5259
- https://lists.debian.org/debian-lts-announce/2020/03/msg00012.html
- https://github.com/advisories/GHSA-3hw5-q855-g6cw