PT-2010-3137 · Mono · Mono

Published 2010-05-27 · Updated 2022-05-02 · CVE-2010-1459

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Mono versions prior to 2.6.4

Description The default configuration of ASP.NET in Mono has a value of FALSE for the EnableViewStateMac property, allowing remote attackers to conduct cross-site scripting (XSS) attacks. This is demonstrated by the VIEWSTATE parameter to "2.0/menu/menu1.aspx" in the XSP sample project.

Recommendations For Mono versions prior to 2.6.4, update to version 2.6.4 or later to resolve the issue. As a temporary workaround, consider setting the EnableViewStateMac property to TRUE to mitigate the risk of XSS attacks. Restrict access to the VIEWSTATE parameter in the affected API endpoint until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2010-1459

GHSA-G5C6-W479-93XM

Affected Products

Mono

References · 13

• https://security-tracker.debian.org/tracker/CVE-2010-1459 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2010-06/msg00001.html · Vendor Advisory
• http://mono-project.com/Vulnerabilities#ASP.NET_View_State_Cross-Site_Scripting · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2010-05/msg00002.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-1459 · Security Note
• http://lists.opensuse.org/opensuse-security-announce/2010-08/msg00001.html · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2010-1459 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-g5c6-w479-93xm · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2010-1459 · Vendor Advisory
• https://github.com/mono/mono · Note
• http://communities.hp.com/securitysoftware/blogs/spilabs/archive/2010/04/29/asp-net-cross-site-scripting-followup-mono.aspx · Note
• http://securityfocus.com/bid/40351 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1459 · Note