PT-2010-3137 · Mono · Mono

Publicado 2010-05-27 · Atualizado 2022-05-02 · CVE-2010-1459

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Mono versions prior to 2.6.4

Description The default configuration of ASP.NET in Mono has a value of FALSE for the EnableViewStateMac property, allowing remote attackers to conduct cross-site scripting (XSS) attacks. This is demonstrated by the VIEWSTATE parameter to "2.0/menu/menu1.aspx" in the XSP sample project.

Recommendations For Mono versions prior to 2.6.4, update to version 2.6.4 or later to resolve the issue. As a temporary workaround, consider setting the EnableViewStateMac property to TRUE to mitigate the risk of XSS attacks. Restrict access to the VIEWSTATE parameter in the affected API endpoint until the issue is resolved.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2010-1459

GHSA-G5C6-W479-93XM

Produtos afetados

Mono

Referências · 13

• https://github.com/mono/mono · Nota
• https://security-tracker.debian.org/tracker/CVE-2010-1459 · Aviso do Fabricante
• http://lists.opensuse.org/opensuse-security-announce/2010-06/msg00001.html · Aviso do Fabricante
• http://communities.hp.com/securitysoftware/blogs/spilabs/archive/2010/04/29/asp-net-cross-site-scripting-followup-mono.aspx · Nota
• http://mono-project.com/Vulnerabilities#ASP.NET_View_State_Cross-Site_Scripting · Aviso do Fabricante
• http://lists.opensuse.org/opensuse-security-announce/2010-05/msg00002.html · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2010-1459 · Nota de Segurança
• http://lists.opensuse.org/opensuse-security-announce/2010-08/msg00001.html · Aviso do Fabricante
• http://securityfocus.com/bid/40351 · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2010-1459 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-g5c6-w479-93xm · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1459 · Nota
• https://osv.dev/vulnerability/CVE-2010-1459 · Aviso do Fabricante