CVEvulnerability

CVE-2010-1459

4.3 MEDIUM Published 2010-05-27 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2010-05-27
Last modified
2026-06-16
Assigner
[email protected]
CVSS 2.0 ([email protected])
4.3 MEDIUM — AV:N/AC:M/Au:N/C:N/I:P/A:N
Weaknesses
CWE-79

Description

The default configuration of ASP.NET in Mono before 2.6.4 has a value of FALSE for the EnableViewStateMac property, which allows remote attackers to conduct cross-site scripting (XSS) attacks, as demonstrated by the __VIEWSTATE parameter to 2.0/menu/menu1.aspx in the XSP sample project.

Affected configurations

• mono mono 1.0 • mono mono 1.0.1 • mono mono 1.0.2 • mono mono 1.0.4 • mono mono 1.0.5 • mono mono 1.0.6 • mono mono 1.1.1 • mono mono 1.1.2 • mono mono 1.1.3 • mono mono 1.1.4 • mono mono 1.1.5 • mono mono 1.1.6 • mono mono 1.1.7 • mono mono 1.1.8 • mono mono 1.1.8.1 • mono mono 1.1.8.3 • mono mono 1.1.9 • mono mono 1.1.9.1 • mono mono 1.1.9.2 • mono mono 1.1.10 • mono mono 1.1.10.1 • mono mono 1.1.11 • mono mono 1.1.12 • mono mono 1.1.12.1 • mono mono 1.1.13 • mono mono 1.1.13.2 • mono mono 1.1.13.4 • mono mono 1.1.13.5 • mono mono 1.1.13.6 • mono mono 1.1.13.7 • mono mono 1.1.13.8 • mono mono 1.1.13.8.1 • mono mono 1.1.14 • mono mono 1.1.15 • mono mono 1.1.16 • mono mono 1.1.16.1 • mono mono 1.1.17 • mono mono 1.1.17.1 • mono mono 1.1.17.2 • mono mono 1.1.18 • mono mono 1.2 • mono mono 1.2.1 • mono mono 1.2.2 • mono mono 1.2.2.1 • mono mono 1.2.3 • mono mono 1.2.3.1 • mono mono 1.2.4 • mono mono 1.2.5 • mono mono 1.2.5.1 • mono mono 1.2.5.2 • mono mono 1.2.6 • mono mono 1.9 • mono mono 1.9.1 • mono mono 2.0 • mono mono 2.0.1 • mono mono 2.2 • mono mono 2.4 • mono mono 2.4.2 • mono mono 2.4.2.1 • mono mono 2.4.2.2 … and 2 more

Related

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References