CVE-2005-0509

Multiple cross-site scripting (XSS) vulnerabilities in the Mono 1.0.5 implementation of ASP.NET (.Net) allow remote attackers to inject arbitrary HTML or web script via Unicode representations for ASCII fullwidth characters that are converted to normal ASCII characters, including ">" and "<".

CVSS v2.0 4.3 MEDIUM

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://secunia.com/advisories/14325	Patch Vendor Advisory
http://it-project.ru/andir/docs/aspxvuln/aspxvuln.en.xml
http://marc.info/?l=bugtraq&m=110867912714913&w=2

Advertisement

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:mono:mono:1.0.5:::::::*
	cpe:2.3:a:microsoft:.net_framework:1.1:::::::*
	cpe:2.3:a:microsoft:.net_framework:1.1:sp1::::::
	cpe:2.3:a:microsoft:.net_framework:1.0:::::::*
	cpe:2.3:a:microsoft:.net_framework:1.0:sp1::::::
	cpe:2.3:a:microsoft:.net_framework:1.0:sp2::::::

Information

Published : 2005-03-13 21:00

Updated : 2016-10-17 20:12

NVD link : CVE-2005-0509

Mitre link : CVE-2005-0509

JSON object : View

CWE

NVD-CWE-Other

Advertisement

Products Affected

microsoft

.net_framework

mono

mono

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://secunia.com/advisories/14325", "name": "14325", "tags": ["Patch", "Vendor Advisory"], "refsource": "SECUNIA"}, {"url": "http://it-project.ru/andir/docs/aspxvuln/aspxvuln.en.xml", "name": "http://it-project.ru/andir/docs/aspxvuln/aspxvuln.en.xml", "tags": [], "refsource": "MISC"}, {"url": "http://marc.info/?l=bugtraq&m=110867912714913&w=2", "name": "20050217 XSS vulnerabilty in ASP.Net [with details]", "tags": [], "refsource": "BUGTRAQ"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "Multiple cross-site scripting (XSS) vulnerabilities in the Mono 1.0.5 implementation of ASP.NET (.Net) allow remote attackers to inject arbitrary HTML or web script via Unicode representations for ASCII fullwidth characters that are converted to normal ASCII characters, including \">\" and \"<\"."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2005-0509", "ASSIGNER": "cve@mitre.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "severity": "MEDIUM", "impactScore": 2.9, "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}}, "publishedDate": "2005-03-14T05:00Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:mono:mono:1.0.5:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:microsoft:.net_framework:1.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:microsoft:.net_framework:1.1:sp1:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:microsoft:.net_framework:1.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:microsoft:.net_framework:1.0:sp1:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:microsoft:.net_framework:1.0:sp2:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2016-10-18T03:12Z"}