CVE-2008-3422 Multiple cross-site scripting (XSS) vulnerabilities in the ASP.net class libraries in Mono 2.0 and earlier allow remote attackers to inject arbitrary web script or HTML via crafted attributes related....
MediumCVSS 4.3
EPSS 1.6%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple cross-site scripting (XSS) vulnerabilities in the ASP.net class libraries in Mono 2.0 and earlier allow remote attackers to inject arbitrary web script or HTML via crafted attributes related to (1) HtmlControl.cs (PreProcessRelativeReference), (2) HtmlForm.cs (RenderAttributes), (3) HtmlInputButton (RenderAttributes), (4) HtmlInputRadioButton (RenderAttributes), and (5) HtmlSelect (RenderChildren).
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| mono | = 1.0 | No fix listed |
| mono | = 1.0.5 | No fix listed |
| mono | = 1.1.4 | No fix listed |
| mono | = 1.1.8.3 | No fix listed |
| mono | = 1.1.13 | No fix listed |
| mono | = 1.1.13.4 | No fix listed |
| mono | = 1.1.13.6 | No fix listed |
| mono | = 1.1.13.7 | No fix listed |
| mono | = 1.1.17 | No fix listed |
| mono | = 1.1.17.1 | No fix listed |
| mono | = 1.1.18 | No fix listed |
| mono | = 1.2.5.1 | No fix listed |
| mono project mono | <= 2.0 | No fix listed |
| mono project mono | = 1.2.1 | No fix listed |
| mono project mono | = 1.2.2 | No fix listed |
| mono project mono | = 1.2.3 | No fix listed |
| mono project mono | = 1.2.4 | No fix listed |
| mono project mono | = 1.2.5 | No fix listed |
| mono project mono | = 1.2.6 | No fix listed |
| mono project mono | = 1.9 | No fix listed |
| debian/mono(Debian:12) | < 1.9.1+dfsg-4 | 1.9.1+dfsg-4 |
| debian/mono(Debian:13) | < 1.9.1+dfsg-4 | 1.9.1+dfsg-4 |
| debian/mono(Debian:14) | < 1.9.1+dfsg-4 | 1.9.1+dfsg-4 |
References
- SUSE-SR:2008:018 vendor-advisory
- [mono-devel-list] 20080726 [PATCH] HTML encode attributes that might need encoding mailing-list
- 31338 third-party-advisory
- 31982 third-party-advisory
- 36494 third-party-advisory
- 30471 vdb-entry
- bugzilla.novell.com
- mono-aspnet-xss(44229) vdb-entry
- USN-826-1 vendor-advisory
- Debian Security Tracker CVE-2008-3422 vendor-advisory
- bugs.debian.org issue-tracking