The default configuration of ASP.NET in Mono before 2.6.4 has a value of FALSE for the EnableViewStateMac property, which allows remote attackers to conduct cross-site scripting (XSS) attacks, as demonstrated by the __VIEWSTATE parameter to 2.0/menu/menu1.aspx in the XSP sample project.
CVSS Details
- CVSS 3.1 Base Score: 6.1
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade mono | Jul 30, 2024 | May 27, 2010 |
| Suse | — | Upgrade mono-wcfUpgrade mono-develUpgrade mono-webUpgrade monodoc-coreUpgrade mono-data-postgresqlUpgrade mono-data-sqliteUpgrade mono-winformsUpgrade mono-extrasUpgrade mono-coreUpgrade mono-winfxcoreUpgrade mono-jscriptUpgrade mono-data-sybaseUpgrade mono-data-firebirdUpgrade mono-dataUpgrade mono-nunitUpgrade mono-data-oracleUpgrade mono-locale-extrasUpgrade bytefx-data-mysql | Feb 17, 2015 | Jun 28, 2013 |
| Ubuntu | — | Upgrade mono | Nov 19, 2024 | May 27, 2010 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub