PT-2010-4051 · Python · Mako

Published 2010-07-02 · Updated 2023-02-13 · CVE-2010-2480

Positive Technologies (AI Summary)

CVSS v4.0

5.3

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions Mako versions prior to 0.3.4

Description The issue makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via vectors involving single-quote characters and a JavaScript onLoad event handler for a BODY element. This is because Mako relies on the cgi.escape function in the Python standard library for XSS protection.

Recommendations For versions prior to 0.3.4, update to version 0.3.4 or later to resolve the issue. As a temporary workaround, consider implementing additional XSS protection measures to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2010-2480

GHSA-7Q8X-38MC-P84F

PYSEC-2010-1

Affected Products

Mako

References · 17

• https://nvd.nist.gov/vuln/detail/CVE-2010-2480 · Security Note
• https://osv.dev/vulnerability/PYSEC-2010-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-7q8x-38mc-p84f · Vendor Advisory
• http://secunia.com/advisories/39935 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2010-2480 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2010-08/msg00001.html · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2010-2480 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2010-2480 · Vendor Advisory
• https://github.com/sqlalchemy/mako · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/mako/PYSEC-2010-1.yaml · Note
• http://makotemplates.org/CHANGES · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=609573 · Note
• https://lists.opensuse.org/opensuse-security-announce/2010-08/msg00001.html · Note
• https://makotemplates.org/CHANGES · Note
• http://bugs.python.org/issue9061 · Note