PT-2005-1563 · Mono · Mono

Andir + 1 · Published 2005-02-22 · Updated 2016-10-18 · CVE-2005-0509

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Mono version 1.0.5

Description The issue allows remote attackers to inject arbitrary HTML or web script via Unicode representations for ASCII fullwidth characters that are converted to normal ASCII characters, including ">" and "<". This is due to multiple cross-site scripting (XSS) vulnerabilities in the Mono implementation of ASP.NET.

Recommendations For Mono version 1.0.5, consider disabling the use of Unicode representations for ASCII fullwidth characters until a patch is available. Restrict input validation to prevent the injection of arbitrary HTML or web script.

Fix

Related Identifiers

CVE-2005-0509

Affected Products

Mono

References · 8

• https://osv.dev/vulnerability/DEBIAN-CVE-2005-0509 · Vendor Advisory
• http://secunia.com/advisories/14325 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2005-0509 · Security Note
• https://osv.dev/vulnerability/CVE-2005-0509 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2005-0509 · Vendor Advisory
• http://it-project.ru/andir/docs/aspxvuln/aspxvuln.en.xml · Note
• http://marc.info/?l=bugtraq&m=110867912714913&w=2 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0509 · Note