CVE-2010-1459

描述

The default configuration of ASP.NET in Mono before 2.6.4 has a value of FALSE for the EnableViewStateMac property, which allows remote attackers to conduct cross-site scripting (XSS) attacks, as demonstrated by the __VIEWSTATE parameter to 2.0/menu/menu1.aspx in the XSP sample project.

如何修補 CVE-2010-1459

要修補 CVE-2010-1459,請將受影響套件升級到下列已修補版本。

• Debian/mono—升級至 2.4.4~svn151842-3 或更新版本
• NuGet/mono—升級至 2.6.4 或更新版本

CVE-2010-1459 正在被利用嗎?

低 — EPSS 為 0.4%,目前沒有觀察到大規模利用活動。

受影響套件(2)

• from 0, < 2.4.4~svn151842-3
• from 0, < 2.6.4

參考連結(9)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2010-1459
• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2010-1459
• PATCHgithub.com/mono/mono
• WEBlists.opensuse.org/opensuse-security-announce/2010-05/msg00002.html
• WEB