CVE-2005-0509

Multiple cross-site scripting (XSS) vulnerabilities in the Mono 1.0.5 implementation of ASP.NET (.Net) allow remote attackers to inject arbitrary HTML or web script via Unicode representations for ASCII fullwidth characters that are converted to normal ASCII characters, including ">" and "<".

CVSS v2.0 4.3 MEDIUM

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://it-project.ru/andir/docs/aspxvuln/aspxvuln.en.xml
http://marc.info/?l=bugtraq&m=110867912714913&w=2
http://secunia.com/advisories/14325	Patch Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:microsoft:.net_framework:1.0:::::::*
	cpe:2.3:a:microsoft:.net_framework:1.0:sp1::::::
	cpe:2.3:a:microsoft:.net_framework:1.0:sp2::::::
	cpe:2.3:a:microsoft:.net_framework:1.1:::::::*
	cpe:2.3:a:microsoft:.net_framework:1.1:sp1::::::
	cpe:2.3:a:mono:mono:1.0.5:::::::*

History

No history.

Information

Published : 2005-03-14 05:00

Updated : 2024-02-04 16:52

NVD link : CVE-2005-0509

Mitre link : CVE-2005-0509

CVE.ORG link : CVE-2005-0509

JSON object : View

Products Affected

mono

mono

microsoft

.net_framework

CWE

NVD-CWE-Other

{"id": "CVE-2005-0509", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2005-03-14T05:00:00.000", "references": [{"url": "http://it-project.ru/andir/docs/aspxvuln/aspxvuln.en.xml", "source": "cve@mitre.org"}, {"url": "http://marc.info/?l=bugtraq&m=110867912714913&w=2", "source": "cve@mitre.org"}, {"url": "http://secunia.com/advisories/14325", "tags": ["Patch", "Vendor Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "Multiple cross-site scripting (XSS) vulnerabilities in the Mono 1.0.5 implementation of ASP.NET (.Net) allow remote attackers to inject arbitrary HTML or web script via Unicode representations for ASCII fullwidth characters that are converted to normal ASCII characters, including \">\" and \"<\"."}], "lastModified": "2016-10-18T03:12:15.247", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:microsoft:.net_framework:1.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "766661C0-6A35-4F62-8325-3840A75CF3B4"}, {"criteria": "cpe:2.3:a:microsoft:.net_framework:1.0:sp1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "603D5B6B-8BDE-491F-A60E-EFFDC9E0BA10"}, {"criteria": "cpe:2.3:a:microsoft:.net_framework:1.0:sp2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8C0CBA3B-6BA9-443B-A40A-46CC1994748F"}, {"criteria": "cpe:2.3:a:microsoft:.net_framework:1.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1A927C9E-5CCC-4FC1-AE63-24B96A5FC51A"}, {"criteria": "cpe:2.3:a:microsoft:.net_framework:1.1:sp1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0BF6AE15-EAC3-4100-A742-211026C79CCC"}, {"criteria": "cpe:2.3:a:mono:mono:1.0.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DBB77289-2AED-4BD4-9578-FEB0EC83701E"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}