$ cve CVE-2010-2273 JSON

CVE-2010-2273 EXPLOIT

4.3

MEDIUM · CVSS 2.0 · EPSS 4.5% (pctl 91)

Patch early

A public exploit exists.

Description

Multiple cross-site scripting (XSS) vulnerabilities in Dojo 1.0.x before 1.0.3, 1.1.x before 1.1.2, 1.2.x before 1.2.4, 1.3.x before 1.3.3, and 1.4.x before 1.4.2 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, possibly related to dojo/resources/iframe_history.html, dojox/av/FLAudio.js, dojox/av/FLVideo.js, dojox/av/resources/audio.swf, dojox/av/resources/video.swf, util/buildscripts/jslib/build.js, and util/buildscripts/jslib/buildUtil.js, as demonstrated by the (1) dojoUrl and (2) testUrl parameters to util/doh/runner.html.

Scoring

CVSS	4.3 (MEDIUM, v2.0)
Vector	AV:N/AC:M/Au:N/C:N/I:P/A:N
EPSS	4.55% — more likely to be exploited than 91% of all CVEs
Weakness	CWE-79
On CISA KEV	no
Public exploit	yes
Published	2010-06-15
Last modified	2026-06-16

Affected (1)

Vendor	Product
dojotoolkit	dojo

Public exploits

Source	Title	Date
exploit-db	Dojo Toolkit 1.4.1 - '/doh/runner.html' Multiple Cross-Site Scripting Vulnerabilities	2010-03-15

References

→ the Explorer · watch your stack · NVD