The default configuration of ASP.NET in Mono before 2.6.4 has a value of FALSE for the EnableViewStateMac property, which allows remote attackers to conduct cross-site scripting (XSS) attacks, as demonstrated by the __VIEWSTATE parameter to 2.0/menu/menu1.aspx in the XSP sample project.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade mono | Jul 30, 2024 | May 27, 2010 |
| Suse | — | Upgrade mono-develUpgrade mono-coreUpgrade mono-winformsUpgrade mono-data-postgresqlUpgrade mono-jscriptUpgrade mono-wcfUpgrade mono-webUpgrade mono-data-sqliteUpgrade monodoc-coreUpgrade mono-extrasUpgrade mono-winfxcoreUpgrade mono-nunitUpgrade bytefx-data-mysqlUpgrade mono-data-oracleUpgrade mono-data-firebirdUpgrade mono-dataUpgrade mono-data-sybaseUpgrade mono-locale-extras | Feb 17, 2015 | Jun 28, 2013 |
| Ubuntu | — | Upgrade mono | Nov 19, 2024 | May 27, 2010 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub