CVEvulnerability
CVE-2012-3382
4.3 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2012-07-12
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 4.3 MEDIUM — AV:N/AC:M/Au:N/C:N/I:P/A:N
- Weaknesses
- CWE-79
Description
Cross-site scripting (XSS) vulnerability in the ProcessRequest function in mcs/class/System.Web/System.Web/HttpForbiddenHandler.cs in Mono 2.10.8 and earlier allows remote attackers to inject arbitrary web script or HTML via a file with a crafted name and a forbidden extension, which is not properly handled in an error message.
Affected configurations
• mono mono (<= 2.10.8)
Related
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- http://www.mandriva.com/security/advisories?name=MDVSA-2012:140 www.mandriva.com
- http://www.openwall.com/lists/oss-security/2012/07/06/11 www.openwall.com
- https://bugzilla.novell.com/show_bug.cgi?id=769799 bugzilla.novell.com
- https://github.com/mono/mono/commit/d16d4623edb210635bec3ca3786481b82cde25a2 Exploit, Patch
- https://hermes.opensuse.org/messages/15374367 hermes.opensuse.org
- http://www.mandriva.com/security/advisories?name=MDVSA-2012:140 www.mandriva.com
- http://www.openwall.com/lists/oss-security/2012/07/06/11 www.openwall.com
- https://bugzilla.novell.com/show_bug.cgi?id=769799 bugzilla.novell.com
- https://github.com/mono/mono/commit/d16d4623edb210635bec3ca3786481b82cde25a2 Exploit, Patch
- https://hermes.opensuse.org/messages/15374367 hermes.opensuse.org