Security readout for executives and security teams
Plain-English summary
Older Dojo deployments before 1.14 may expose a cross-site scripting issue in Dojo’s test harness pages. If those pages are reachable on a trusted site, a victim could be tricked into browsing through attacker-controlled content while the target domain is abused in their browser.
Executive priority
Treat this as a targeted web exposure cleanup item, not an emergency based on current evidence. Prioritize internet-facing trusted domains running older Dojo or exposing test files, because browser-side compromise can affect user trust and session confidentiality.
Technical view
The CVE identifies XSS in Dojo Objective Harness files including unit.html, testsDOH/_base/loader/i18n-exhaustive/i18n-test/unit.html, and testsDOH/_base/i18nExhaustive.js. The source states the issue appears fixed in Dojo 1.14. No CVSS, CWE, CPE, or detailed affected package metadata is supplied.
Likely exposure
Exposure is most plausible where web applications deploy Dojo before 1.14 and leave DOH test harness files reachable under trusted domains. Production apps that do not ship these test files may not expose this specific issue. The source bundle does not define affected CPEs or packaged products.
Exploitation context
The CVE describes victim-driven exploitation: users are lured to attacker-controlled content, then the XSS on the target domain is silently abused. The bundle mentions possible malware delivery, cookie theft, and CORS trust bypass. CISA KEV is false, and no cited source states active exploitation.
Researcher notes
The public metadata is thin: no CVSS vector, CWE, CPE, or patch diff details beyond references. Validate exposure by version and file reachability. Avoid assuming all Dojo consumers are affected; the described vulnerable surface is DOH test harness content before 1.14.
Mitigation direction
- Upgrade Dojo to version 1.14 or later where feasible.
- Remove DOH test harness files from public production deployments.
- Restrict access to any retained test or development-only Dojo paths.
- Review Dojo release notes and PR 307 for vendor context.
Validation and detection
- Inventory applications using Dojo versions earlier than 1.14.
- Check public web roots for the named DOH test harness files.
- Confirm production deployments do not expose testsDOH paths.
- Verify upgraded applications report Dojo 1.14 or later.
- Review access logs for unexpected requests to DOH test paths.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2018-1000665 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://dojotoolkit.org/blog/dojo-1-14-releasedCVE reference · x_refsource_CONFIRM
- https://github.com/dojo/dojo/pull/307CVE reference · x_refsource_CONFIRM
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.