Vulnerability detected on DX

HCL Digital Experience Digital Experience Forum
,
1

Hi, we were informed of these vulnerabilities in DX v8.5 related to the Dojo library:
"Vulnerable javascript library: Dojo version: 1.9.7_IBM"

1. CVE-2018-15494: Dojo toolkit versions before 1.10.10 have unescaped string injection in dojox/Grid/DataGrid which makes it vulnerable to Cross-site scripting(XSS) attacks when editing rows in dojox/Grid/DataGrid

2. CVE-2020-5258: The deepCopy method within Dojo toolkit versions below 1.11.10 is vulnerable to Prototype Pollution. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values.

how can we solve them?

is this library also present in DX v9.5?

Thanks

2

Hello Damiano,

For the first CVE mentioned, it was addressed in the CF17 cumulative fix update.
Please see the following Security Bulletin:

https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0073317

The second CVE, was addressed in CF199 and later.
Detailed in the following security Bulletin:
https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0094304

Please let us know if you have further questions.
Thank you
Mike