CVE-2010-2274: Medium severity dojo toolkit vulnerability
Multiple open redirect vulnerabilities in Dojo 1.0.x before 1.0.3, 1.1.x before 1.1.2, 1.2.x before 1.2.4, 1.3.x before 1.3.3, and 1.4.x before 1.4.2 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors, possibly related to dojo/resources/iframehistory.html, dojox/av/FLAudio.js, dojox/av/FLVideo.js, dojox/av/resources/audio.swf, dojox/av/resources/video.swf, util/buildscripts/jslib/build.js, util/buildscripts/jslib/buildUtil.js, and util/doh/runner.html.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2010-2274?
CVE-2010-2274 has a medium severity level as it allows for open redirects, which can lead to phishing attacks.
How do I fix CVE-2010-2274?
To resolve CVE-2010-2274, upgrade to Dojo Toolkit version 1.0.3 or later, specifically 1.4.2 or above.
What versions of Dojo are affected by CVE-2010-2274?
CVE-2010-2274 affects Dojo versions 1.0.x before 1.0.3, 1.1.x before 1.1.2, 1.2.x before 1.2.4, 1.3.x before 1.3.3, and 1.4.x before 1.4.2.
Can CVE-2010-2274 be exploited remotely?
Yes, CVE-2010-2274 can be exploited remotely by attackers to redirect users to arbitrary websites.
What should I do if I can't upgrade from Dojo due to compatibility issues with CVE-2010-2274?
If upgrading is not feasible, consider implementing URL validation and additional security measures to mitigate the risks associated with CVE-2010-2274.