CVE-2010-1459: XSS
The default configuration of ASP.NET in Mono before 2.6.4 has a value of FALSE for the EnableViewStateMac property, which allows remote attackers to conduct cross-site scripting (XSS) attacks, as demonstrated by the VIEWSTATE parameter to 2.0/menu/menu1.aspx in the XSP sample project.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2010-1459?
CVE-2010-1459 is classified as a medium severity vulnerability due to its potential for cross-site scripting (XSS) attacks.
How do I fix CVE-2010-1459?
To fix CVE-2010-1459, upgrade to Mono version 2.6.4 or later where the EnableViewStateMac property is set to TRUE by default.
What type of attacks are possible with CVE-2010-1459?
CVE-2010-1459 allows remote attackers to conduct cross-site scripting (XSS) attacks by exploiting the __VIEWSTATE parameter.
Which versions of Mono are affected by CVE-2010-1459?
CVE-2010-1459 affects all versions of Mono prior to 2.6.4, including 1.0 up to 2.6.3.
What does the EnableViewStateMac property do in relation to CVE-2010-1459?
The EnableViewStateMac property, when set to FALSE, compromises the integrity of the view state in ASP.NET, making it vulnerable to XSS attacks as demonstrated in CVE-2010-1459.