CVE-2020-4051

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

In Dijit before versions 1.11.11, and greater than or equal to 1.12.0 and less than 1.12.9, and greater than or equal to 1.13.0 and less than 1.13.8, and greater than or equal to 1.14.0 and less than 1.14.7, and greater than or equal to 1.15.0 and less than 1.15.4, and greater than or equal to 1.16.0 and less than 1.16.3, there is a cross-site scripting vulnerability in the Editor's LinkDialog plugin. This has been fixed in 1.11.11, 1.12.9, 1.13.8, 1.14.7, 1.15.4, 1.16.3.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Dojo	dijit	< 1.11.11; >= 1.12.0, < 1.12.9; >= 1.13.0, < 1.13.8; >= 1.14.0, < 1.14.7; >= 1.15.0, < 1.15.4; >= 1.16.0, < 1.16.3

References

https://github.com/dojo/dijit/commit/462bdcd60d0333315fe69ab4709c894d78f61301Patch, Third Party Advisory
https://github.com/dojo/dijit/security/advisories/GHSA-cxjc-r2fp-7mq6Third Party Advisory
https://lists.debian.org/debian-lts-announce/2023/01/msg00030.htmlMailing List, Third Party Advisory
https://security.netapp.com/advisory/ntap-20201023-0003/Third Party Advisory
https://www.oracle.com/security-alerts/cpuoct2020.htmlPatch, Third Party Advisory
https://github.com/dojo/dijit/commit/462bdcd60d0333315fe69ab4709c894d78f61301Patch, Third Party Advisory
https://github.com/dojo/dijit/security/advisories/GHSA-cxjc-r2fp-7mq6Third Party Advisory
https://lists.debian.org/debian-lts-announce/2023/01/msg00030.htmlMailing List, Third Party Advisory
https://security.netapp.com/advisory/ntap-20201023-0003/Third Party Advisory
https://www.oracle.com/security-alerts/cpuoct2020.htmlPatch, Third Party Advisory

Timeline

Published: Jun 15, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-40526.1In Wiki.js before 2.4.107, there is a stored cross-site scripting through template injection. This vulnerability exists due to an insecure v CVE-2020-40536.8In Helm greater than or equal to 3.0.0 and less than 3.2.4, a path traversal attack is possible when installing Helm plugins from a tar arch CVE-2020-40547.3In Sanitize (RubyGem sanitize) greater than or equal to 3.0.0 and less than 5.2.1, there is a cross-site scripting vulnerability. When HTML CVE-2020-40597.3In mversion before 2.0.0, there is a command injection vulnerability. This issue may lead to remote code execution if a client of the librar CVE-2020-40605.0In LoRa Basics Station before 2.0.4, there is a Use After Free vulnerability that leads to memory corruption. This bug is triggered on 32-bi CVE-2020-40615.4In October from version 1.0.319 and before version 1.0.467, pasting content copied from malicious websites into the Froala richeditor could CVE-2020-40629.0In Conjur OSS Helm Chart before 2.0.0, a recently identified critical vulnerability resulted in the installation of the Conjur Postgres data CVE-2020-40667.2In Limdu before 0.95, the trainBatch function has a command injection vulnerability. Clients of the Limdu library are unlikely to be aware o CVE-2020-40677.5In coturn before version 4.5.1.3, there is an issue whereby STUN/TURN response buffer is not initialized properly. There is a leak of inform CVE-2020-40689.8In APNSwift 1.0.0, calling APNSwiftSigner.sign(digest:) is likely to result in a heap buffer overflow. This has been fixed in 1.0.1.CVE-2020-40705.4In CSS Validator less than or equal to commit 54d68a1, there is a cross-site scripting vulnerability in handling URIs. A user would have to CVE-2020-40712.4In django-basic-auth-ip-whitelist before 0.3.4, a potential timing attack exists on websites where the basic authentication is used or confi