{"id":"CVE-2010-2273","aliases":["GHSA-536q-8gxx-m782"],"url":"https://o3.security/vulnerability/CVE-2010-2273","summary":"Cross-Site Scripting in dojo","details":"Multiple cross-site scripting (XSS) vulnerabilities in Dojo 1.0.x before 1.0.3, 1.1.x before 1.1.2, 1.2.x before 1.2.4, 1.3.x before 1.3.3, and 1.4.x before 1.4.2 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, possibly related to dojo/resources/iframe_history.html, dojox/av/FLAudio.js, dojox/av/FLVideo.js, dojox/av/resources/audio.swf, dojox/av/resources/video.swf, util/buildscripts/jslib/build.js, and util/buildscripts/jslib/buildUtil.js, as demonstrated by the (1) dojoUrl and (2) testUrl parameters to util/doh/runner.html.","published":"2010-06-15T14:30:01Z","modified":"2026-04-10T03:41:16.547979Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":3,"affectedPackages":[{"ecosystem":"npm","name":"dojo","fixedVersion":"1.13.1"},{"ecosystem":"npm","name":"dojo","fixedVersion":"1.12.4"},{"ecosystem":"npm","name":"dojo","fixedVersion":"1.11.6"},{"ecosystem":"npm","name":"dojo","fixedVersion":"1.10.10"}],"fix":{"url":"https://github.com/dojo/dojo/pull/307","label":"dojo/dojo#307"},"references":[{"type":"ADVISORY","url":"http://dojotoolkit.org/blog/post/dylan/2010/03/dojo-security-advisory/"},{"type":"ADVISORY","url":"http://secunia.com/advisories/38964"},{"type":"ADVISORY","url":"http://secunia.com/advisories/40007"},{"type":"ADVISORY","url":"http://www.vupen.com/english/advisories/2010/1281"},{"type":"EVIDENCE","url":"http://bugs.dojotoolkit.org/ticket/10773"},{"type":"EVIDENCE","url":"http://www.gdssecurity.com/l/b/2010/03/12/multiple-dom-based-xss-in-dojo-toolkit-sdk/"},{"type":"WEB","url":"http://www-01.ibm.com/support/docview.wss?uid=swg21431472"},{"type":"WEB","url":"http://www-1.ibm.com/support/docview.wss?uid=swg1LO50833"},{"type":"WEB","url":"http://www-1.ibm.com/support/docview.wss?uid=swg1LO50849"},{"type":"WEB","url":"http://www-1.ibm.com/support/docview.wss?uid=swg1LO50856"},{"type":"WEB","url":"http://www-1.ibm.com/support/docview.wss?uid=swg1LO50896"},{"type":"WEB","url":"http://www-1.ibm.com/support/docview.wss?uid=swg1LO50932"},{"type":"WEB","url":"http://www-1.ibm.com/support/docview.wss?uid=swg1LO50958"},{"type":"WEB","url":"http://www-1.ibm.com/support/docview.wss?uid=swg1LO50994"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2010-2273"},{"type":"WEB","url":"https://github.com/dojo/dojo/pull/307"},{"type":"WEB","url":"https://github.com/dojo/dojo/commit/9117ffd5a3863e44c92fcd58564c0da22be858f4"},{"type":"WEB","url":"https://bugs.dojotoolkit.org/ticket/10773"},{"type":"WEB","url":"https://www.npmjs.com/advisories/972"},{"type":"WEB","url":"http://dojotoolkit.org/blog/post/dylan/2010/03/dojo-security-advisory"},{"type":"WEB","url":"http://www.gdssecurity.com/l/b/2010/03/12/multiple-dom-based-xss-in-dojo-toolkit-sdk"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-04-10T03:41:16.547979Z"}}