Cross-site scripting (XSS) vulnerability in the ProcessRequest function in mcs/class/System.Web/System.Web/HttpForbiddenHandler.cs in Mono 2.10.8 and earlier allows remote attackers to inject arbitrary web script or HTML via a file with a crafted name and a forbidden extension, which is not properly handled in an error message.
CVSS Details
- CVSS 3.1 Base Score: 4.7
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade mono | Jul 30, 2024 | Jul 12, 2012 |
| Suse | — | Upgrade mono-coreUpgrade mono-nunitUpgrade mono-dataUpgrade mono-locale-extrasUpgrade mono-data-oracleUpgrade mono-data-sybaseUpgrade ibm-data-db2Upgrade bytefx-data-mysqlUpgrade mono-data-firebirdUpgrade mono-data-postgresqlUpgrade mono-extrasUpgrade monodoc-coreUpgrade mono-data-sqliteUpgrade mono-winfxcoreUpgrade mono-develUpgrade mono-wcfUpgrade mono-webUpgrade mono-winformsUpgrade mono-jscript | Dec 12, 2013 | Jun 28, 2013 |
| Ubuntu | — | Upgrade libmono-system-web4.0-cilUpgrade libmono-system-web2.0-cilUpgrade libmono-system-web1.0-cil | Nov 8, 2024 | Jul 12, 2012 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub