Lucene search
IBM804AB06C21622341536BEDD77612E8FCBBBF405DC06A73B57D74C1D47824921BHistoryJun 08, 2021 - 10:33 p.m.
Security Bulletin: IBM DataPower Gateway affected by XSS vulnerability (CVE-2019-10785)
2021-06-0822:33:53
www.ibm.com
12
0.002 Low
EPSS
Percentile
58.4%
Summary
IBM has addressed the CVE
Vulnerability Details
CVEID:CVE-2019-10785
**DESCRIPTION:**Dojox is vulnerable to cross-site scripting, caused by improper validation of user-supplied input by the dojox.xmpp.util.xmlEncode. A remote attacker could exploit this vulnerability to execute script in a victim’s Web browser within the security context of the hosting Web site. An attacker could use this vulnerability to steal the victim’s cookie-based authentication credentials.
CVSS Base score: 6.1
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/176460 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Affected Products and Versions
| Affected Product(s) | Version(s) |
|---|---|
| IBM DataPower Gateway | 2018.4.1.0-2018.4.1.10 |
Remediation/Fixes
| Affected Product(s) | Fixed in Version | APAR |
|---|---|---|
| IBM DataPower Gateway | 2018.4.1.11 | IT32202 |
Workarounds and Mitigations
None
| CPE | Name | Operator | Version |
|---|---|---|---|
| ibm datapower gateway | ge | 2018.4.1.0 | |
| ibm datapower gateway | le | 2018.4.1.10 |
Related
nessus
nessus
Debian DLA-2127-1 : dojo security update
2020-03-02 00:00:00
prion
prion
Cross site scripting
2020-02-13 17:15:00
nvd
nvd
CVE-2019-10785
2020-02-13 17:15:29
ubuntucve
ubuntucve
CVE-2019-10785
2020-02-13 00:00:00
openvas
openvas
Debian: Security Advisory (DLA-2127-1)
2020-03-01 00:00:00
Mageia: Security Advisory (MGASA-2020-0126)
2022-01-28 00:00:00
redhatcve
redhatcve
CVE-2019-10785
2020-05-04 14:09:54
osv
osv
dojo - security update
2020-02-29 00:00:00
XSS in dojox due to insufficient escape in dojox.xmpp.util.xmlEncode
2020-02-13 22:21:06
CVE-2019-10785
2020-02-13 17:15:29
debiancve
debiancve
CVE-2019-10785
2020-02-13 17:15:29
github
github
XSS in dojox due to insufficient escape in dojox.xmpp.util.xmlEncode
2020-02-13 22:21:06
veracode
veracode
Cross-Site Scripting (XSS)
2020-02-14 05:34:58
cvelist
cvelist
CVE-2019-10785
2020-02-13 16:02:46
mageia
mageia
Updated dojo packages fix security vulnerability
2020-03-06 19:13:58
ibm
ibm
cve
cve
CVE-2019-10785
2020-02-13 17:15:29
githubexploit
githubexploit
Exploit for Cross-site Scripting in Linuxfoundation Dojox
2020-12-01 09:18:57
debian
debian
[SECURITY] [DLA 2127-1] dojo security update
2020-02-29 10:58:42
0.002 Low
EPSS
Percentile
58.4%
Related for 804AB06C21622341536BEDD77612E8FCBBBF405DC06A73B57D74C1D47824921B