Unscored severity · published Jul 31, 2008
CVE-2008-3422
Multiple cross-site scripting (XSS) vulnerabilities in the ASP.net class libraries in Mono 2.0 and earlier allow remote attackers to inject arbitrary web script or HTML via…
–
CVSS
1.6%
EPSS
No
On KEV
Description
Multiple cross-site scripting (XSS) vulnerabilities in the ASP.net class libraries in Mono 2.0 and earlier allow remote attackers to inject arbitrary web script or HTML via crafted attributes related to (1) HtmlControl.cs (PreProcessRelativeReference), (2) HtmlForm.cs (RenderAttributes), (3) HtmlInputButton (RenderAttributes), (4) HtmlInputRadioButton (RenderAttributes), and (5) HtmlSelect (RenderChildren).
Exploitation
Is it being used?
Exploit prediction (EPSS)1.6% · higher than 75% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MO
Mono · Mono
1.0; 1.0.5; 1.1.4; 1.1.8.3; 1.1.13; 1.1.13.4; +6 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2008-3422
CVE.org
https://www.cve.org/CVERecord?id=CVE-2008-3422
lists.opensuse.org
http://lists.opensuse.org/opensuse-security-announce/2008-09/msg00004.html
lists.ximian.com
http://lists.ximian.com/pipermail/mono-devel-list/2008-July/028633.html
secunia.com
http://secunia.com/advisories/31338
secunia.com
http://secunia.com/advisories/31982
secunia.com
http://secunia.com/advisories/36494
www.securityfocus.com
http://www.securityfocus.com/bid/30471
More from Mono
–
CVE-2012-3382
Cross-site scripting (XSS) vulnerability in the ProcessRequest function in mcs/class/System.Web/System.Web/HttpForbiddenHandler.cs in Mono 2.10.8 and earlier allows remote…
–
CVE-2011-0992
Use-after-free vulnerability in Mono, when Moonlight 2.x before 2.4.1 or 3.x before 3.99.3 is used, allows remote attackers to cause a denial of service (plugin crash) or obtain…
–
CVE-2011-0991
Use-after-free vulnerability in Mono, when Moonlight 2.x before 2.4.1 or 3.x before 3.99.3 is used, allows remote attackers to cause a denial of service or possibly have…
–
CVE-2011-0990
Race condition in the FastCopy optimization in the Array.Copy method in metadata/icall.c in Mono, when Moonlight 2.x before 2.4.1 or 3.x before 3.99.3 is used, allows remote…
–
CVE-2011-0989
The RuntimeHelpers.InitializeArray method in metadata/icall.c in Mono, when Moonlight 2.x before 2.4.1 or 3.x before 3.99.3 is used, does not properly restrict data types, which…