logo

Database

Server side cross-site scripting In mako

Description

Mako contains Cross-site Scripting vulnerability Mako before 0.3.4 relies on the cgi.escape function in the Python standard library for cross-site scripting (XSS) protection, which makes it easier for remote attackers to conduct XSS attacks via vectors involving single-quote characters and a JavaScript onLoad event handler for a BODY element.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem
Component
Affected version
Patched versions

Aliases

1. CVE-2010-24802. NVD-2010-24803. OSV-2010-24804. OSV-DEBIAN-2010-24805. GCVE-2010-24806. ACCESS-CVE-2010-24807. SECURITY-TRACKER-CVE-2010-2480

References

1. https://bugs.python.org/issue90612. https://bugzilla.redhat.com/show_bug.cgi?id=6095733. https://github.com/pypa/advisory-database/tree/main/vulns/mako/PYSEC-2010-1.yaml4. https://lists.opensuse.org/opensuse-security-announce/2010-08/msg00001.html5. https://www.makotemplates.org/CHANGES6. http://bugs.python.org/issue90617. http://lists.opensuse.org/opensuse-security-announce/2010-08/msg00001.html8. http://www.makotemplates.org/CHANGES

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.