CVE-2008-3422 — Cross-site Scripting in Project Mono

CWE-79 — Cross-site Scripting8 documents8 sources
Severity
4.3MEDIUMNVD
EPSS
0.7%
top 29.13%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
MonoMono Project Mono
Timeline
PublishedJul 31
Latest updateMay 2

Description

Multiple cross-site scripting (XSS) vulnerabilities in the ASP.net class libraries in Mono 2.0 and earlier allow remote attackers to inject arbitrary web script or HTML via crafted attributes related to (1) HtmlControl.cs (PreProcessRelativeReference), (2) HtmlForm.cs (RenderAttributes), (3) HtmlInputButton (RenderAttributes), (4) HtmlInputRadioButton (RenderAttributes), and (5) HtmlSelect (RenderChildren).

CVSS vector

AV:N/AC:M/C:N/I:P/A:NExploitability: 8.6 | Impact: 2.9

Affected Packages3 packages

▶Debianmono/mono< 1.9.1+dfsg-4+3
▶NVDmono/mono12 versions+11

🔴Vulnerability Details

3
GHSA
GHSA-xfvr-xq7r-qx2q: Multiple cross-site scripting (XSS) vulnerabilities in the ASP↗2022-05-02
▶
OSV
CVE-2008-3422: Multiple cross-site scripting (XSS) vulnerabilities in the ASP↗2008-07-31
▶
CVEList
CVE-2008-3422: Multiple cross-site scripting (XSS) vulnerabilities in the ASP↗2008-07-31
▶

📋Vendor Advisories

3
Ubuntu
Mono vulnerabilities↗2009-08-26
▶
Red Hat
mono: XSS vulnerabilities in the ASP.net class libraries↗2008-07-31
▶
Debian
CVE-2008-3422: mono - Multiple cross-site scripting (XSS) vulnerabilities in the ASP.net class librari...↗2008
▶

💬Community

1
Bugzilla
CVE-2008-3422 mono: XSS vulnerabilities in the ASP.net class libraries↗2008-08-01
▶