PT-2010-4051 · Python · Mako

CVE-2010-2480 · Publicado 2010-07-02 · Atualizado 2023-02-13

Positive Technologies (AI Summary)

CVSS v4.0

5.3

Média

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions Mako versions prior to 0.3.4

Description The issue makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via vectors involving single-quote characters and a JavaScript onLoad event handler for a BODY element. This is because Mako relies on the cgi.escape function in the Python standard library for XSS protection.

Recommendations For versions prior to 0.3.4, update to version 0.3.4 or later to resolve the issue. As a temporary workaround, consider implementing additional XSS protection measures to minimize the risk of exploitation.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2010-2480

GHSA-7Q8X-38MC-P84F

PYSEC-2010-1

Produtos afetados

Mako

Referências · 18

• https://github.com/sqlalchemy/mako · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/mako/PYSEC-2010-1.yaml · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2010-2480 · Nota de Segurança
• https://security-tracker.debian.org/tracker/CVE-2010-2480 · Aviso do Fabricante
• https://lists.opensuse.org/opensuse-security-announce/2010-08/msg00001.html · Nota
• http://bugs.python.org/issue9061 · Nota
• https://access.redhat.com/security/cve/CVE-2010-2480 · Nota
• https://github.com/advisories/GHSA-7q8x-38mc-p84f · Nota
• http://lists.opensuse.org/opensuse-security-announce/2010-08/msg00001.html · Aviso do Fabricante
• http://secunia.com/advisories/39935 · Aviso do Fabricante
• https://makotemplates.org/CHANGES · Nota
• https://bugzilla.redhat.com/show_bug.cgi?id=609573 · Nota
• https://osv.dev/vulnerability/CVE-2010-2480 · Aviso do Fabricante
• http://makotemplates.org/CHANGES · Nota
• https://bugs.python.org/issue9061 · Nota