Vulnerability Name:

CVE-2012-3382 (CCN-76817)

Assigned:2012-07-06
Published:2012-07-06
Updated:2013-04-05
Summary:Cross-site scripting (XSS) vulnerability in the ProcessRequest function in mcs/class/System.Web/System.Web/HttpForbiddenHandler.cs in Mono 2.10.8 and earlier allows remote attackers to inject arbitrary web script or HTML via a file with a crafted name and a forbidden extension, which is not properly handled in an error message.
CVSS v3 Severity:5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): Low
Availibility (A): None
CVSS v2 Severity:4.3 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
3.7 Low (Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N/E:H/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Authentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): Partial
Availibility (A): None
4.3 Medium (CCN CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
3.7 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N/E:H/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Athentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): Partial
Availibility (A): None
Vulnerability Type:CWE-79
Vulnerability Consequences:Gain Access
References:Source: MITRE
Type: CNA
CVE-2012-3382

Source: CCN
Type: SA49838
Mono "ProcessRequest()" Cross-Site Scripting Vulnerability

Source: DEBIAN
Type: DSA-2512
mono -- missing input sanitising

Source: MANDRIVA
Type: UNKNOWN
MDVSA-2012:140

Source: CCN
Type: oss-security: Kurt Seifried | 6 Jul
VE Request: XSS in a Mono System.web error page

Source: MLIST
Type: UNKNOWN
[oss-security] 20120706 Re: CVE Request: XSS in a Mono System.web error page

Source: CCN
Type: OSVDB ID: 83683
Mono mcs/class/System.Web/System.Web/HttpForbiddenHandler.cs ProcessRequest() Function Query String XSS

Source: CCN
Type: BID-54344
Mono 'HttpForbiddenHandler.cs' Cross-Site Scripting Vulnerability

Source: MISC
Type: UNKNOWN
https://bugzilla.novell.com/show_bug.cgi?id=769799

Source: XF
Type: UNKNOWN
mono-processrequest-xss(76817)

Source: CCN
Type: Mono GIT Repository
Mono

Source: CONFIRM
Type: Exploit, Patch
https://github.com/mono/mono/commit/d16d4623edb210635bec3ca3786481b82cde25a2

Source: SUSE
Type: UNKNOWN
openSUSE-SU-2012:0974

Vulnerable Configuration:Configuration 1:
  • cpe:/a:mono:mono:*:*:*:*:*:*:*:* (Version <= 2.10.8)

    • Configuration CCN 1:
  • cpe:/a:mono:mono:2.6.7:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.opensuse.security:def:42400
    P
    		Security update for the Linux Kernel (Important)
    2022-06-24
    oval:org.opensuse.security:def:20123382
    V
    		CVE-2012-3382
    2022-05-20
    oval:org.opensuse.security:def:33111
    P
    		Security update for the Linux Kernel (Important) (in QA)
    2022-01-17
    oval:org.opensuse.security:def:57197
    P
    		Security update for libsndfile (Important)
    2022-01-05
    oval:org.opensuse.security:def:26218
    P
    		Security update for java-1_8_0-ibm (Important) (in QA)
    2022-01-04
    oval:org.opensuse.security:def:31721
    P
    		Security update for log4j (Important)
    2021-12-17
    oval:org.opensuse.security:def:33749
    P
    		Security update for webkit2gtk3 (Important)
    2021-12-01
    oval:org.opensuse.security:def:31710
    P
    		Security update for java-1_7_0-openjdk (Important)
    2021-11-24
    oval:org.opensuse.security:def:29450
    P
    		Security update for java-1_8_0-openjdk (Important)
    2021-11-23
    oval:org.opensuse.security:def:31709
    P
    		Security update for java-1_8_0-openjdk (Important)
    2021-11-23
    oval:org.opensuse.security:def:26166
    P
    		Security update for php74 (Moderate)
    2021-11-18
    oval:org.opensuse.security:def:57123
    P
    		Security update for MozillaFirefox (Important)
    2021-11-17
    oval:org.opensuse.security:def:33032
    P
    		Security update for open-lldp (Moderate)
    2021-10-26
    oval:org.opensuse.security:def:26155
    P
    		Security update for cairo (Low)
    2021-10-22
    oval:org.opensuse.security:def:26154
    P
    		Security update for ncurses (Moderate)
    2021-10-20
    oval:org.opensuse.security:def:33021
    P
    		Security update for libqt5-qtsvg (Moderate)
    2021-10-11
    oval:org.opensuse.security:def:33020
    P
    		Security update for python36 (Moderate)
    2021-10-09
    oval:org.opensuse.security:def:26134
    P
    		Security update for the Linux Kernel (Important)
    2021-09-23
    oval:org.opensuse.security:def:34534
    P
    		Security update for grilo (Important)
    2021-09-09
    oval:org.opensuse.security:def:33700
    P
    		Security update for fetchmail (Moderate)
    2021-08-18
    oval:org.opensuse.security:def:32163
    P
    		Security update for MozillaFirefox (Important)
    2021-08-17
    oval:org.opensuse.security:def:34494
    P
    		Security update for linuxptp (Important)
    2021-07-28
    oval:org.opensuse.security:def:26077
    P
    		Security update for apache2 (Important)
    2021-06-17
    oval:org.opensuse.security:def:36243
    P
    		mono-core-2.6.7-0.13.1 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:42650
    P
    		mono-core-2.6.7-0.13.1 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:36381
    P
    		bytefx-data-mysql-2.6.7-0.13.1 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:29365
    P
    		Security update for libxml2 (Important)
    2021-05-19
    oval:org.opensuse.security:def:33643
    P
    		Security update for cups (Important)
    2021-04-30
    oval:org.opensuse.security:def:32076
    P
    		Security update for the Linux Kernel (Live Patch 34 for SLE 12 SP3) (Important)
    2021-04-28
    oval:org.opensuse.security:def:55169
    P
    		Security update for xorg-x11-server (Important)
    2021-04-14
    oval:org.opensuse.security:def:33788
    P
    		Security update for openssl-1_1 (Important)
    2021-03-25
    oval:org.opensuse.security:def:26215
    P
    		Security update for openssl-1_1 (Important)
    2021-03-25
    oval:org.opensuse.security:def:55847
    P
    		Security update for jasper (Important)
    2021-02-16
    oval:org.opensuse.security:def:32019
    P
    		Security update for clamav (Important)
    2020-12-22
    oval:org.opensuse.security:def:29308
    P
    		Security update for spice (Important)
    2020-12-16
    oval:org.opensuse.security:def:35993
    P
    		mono-core-2.6.7-0.9.1 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:25942
    P
    		Security update for gstreamer-0_10-plugins-bad (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26496
    P
    		Security update for tmux (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26833
    P
    		tgt on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:27568
    P
    		struts on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26439
    P
    		Security update for MozillaThunderbird (Important)
    2020-12-01
    oval:org.opensuse.security:def:27715
    P
    		Security update for binutils
    2020-12-01
    oval:org.opensuse.security:def:27861
    P
    		Security update for pwlib
    2020-12-01
    oval:org.opensuse.security:def:27084
    P
    		apache2-mod_php53 on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:27288
    P
    		sblim-sfcb on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:29603
    P
    		Security update for axis (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:29763
    P
    		Security update for glib2 (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:29091
    P
    		Security update for ghostscript-library (Important)
    2020-12-01
    oval:org.opensuse.security:def:55728
    P
    		Security update for qemu (Important)
    2020-12-01
    oval:org.opensuse.security:def:54346
    P
    		pam-modules on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:32424
    P
    		Security update for wpa_supplicant (Important)
    2020-12-01
    oval:org.opensuse.security:def:33167
    P
    		libnewt0_52 on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:33856
    P
    		Security update for inst-source-utils
    2020-12-01
    oval:org.opensuse.security:def:33246
    P
    		pyxml on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26422
    P
    		Security update for Chromium (Important)
    2020-12-01
    oval:org.opensuse.security:def:26568
    P
    		java-1_6_0-ibm on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25792
    P
    		Security update for libvirt (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25996
    P
    		Security update for libvirt (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26507
    P
    		Security update for cacti, cacti-spine (Important)
    2020-12-01
    oval:org.opensuse.security:def:26662
    P
    		PackageKit on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26006
    P
    		Security update for mariadb (Important)
    2020-12-01
    oval:org.opensuse.security:def:26580
    P
    		libQtWebKit4-32bit on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26872
    P
    		cifs-utils on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:27603
    P
    		Security update for Mono
    2020-12-01
    oval:org.opensuse.security:def:27427
    P
    		kopete-devel on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:27764
    P
    		Security update for guestfs
    2020-12-01
    oval:org.opensuse.security:def:28499
    P
    		Security update for openldap2 (Important)
    2020-12-01
    oval:org.opensuse.security:def:27085
    P
    		apache2-mod_security2 on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:27370
    P
    		apache2-mod_perl on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:29657
    P
    		Security update for curl (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:29807
    P
    		Security update for jakarta-commons-collections (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:29010
    P
    		Security update for gnutls (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:29222
    P
    		Security update for php53 (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:55454
    P
    		Security update for openssl (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:55766
    P
    		Security update for ImageMagick (Important)
    2020-12-01
    oval:org.opensuse.security:def:54486
    P
    		gpgme on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:32463
    P
    		Security update for xorg-x11-libXpm (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:33206
    P
    		mono-core on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:33398
    P
    		Security update for cobbler (Important)
    2020-12-01
    oval:org.opensuse.security:def:33341
    P
    		Security update for openldap2 (Important)
    2020-12-01
    oval:org.opensuse.security:def:26471
    P
    		Security update for Mozilla Thunderbird (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:27206
    P
    		libpixman-1-0 on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25793
    P
    		Security update for icedtea-web (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26560
    P
    		gstreamer-0_10-plugins-base on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26706
    P
    		ghostscript-fonts-other on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25930
    P
    		Security update for ImageMagick (Important)
    2020-12-01
    oval:org.opensuse.security:def:26731
    P
    		krb5-plugin-kdb-ldap on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26886
    P
    		ecryptfs-utils-32bit on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26230
    P
    		Security update for libreoffice (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:27511
    P
    		lxc on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:27803
    P
    		Security update for pixman
    2020-12-01
    oval:org.opensuse.security:def:28534
    P
    		Security update for Mono
    2020-12-01
    oval:org.opensuse.security:def:27096
    P
    		clamav on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:29706
    P
    		Security update for Mozilla Firefox
    2020-12-01
    oval:org.opensuse.security:def:30445
    P
    		Security update for ark
    2020-12-01
    oval:org.opensuse.security:def:29011
    P
    		Security update for graphviz (Low)
    2020-12-01
    oval:org.opensuse.security:def:55562
    P
    		security update for xen (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:54323
    P
    		libvirt on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:54724
    P
    		argyllcms on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:32319
    P
    		Security update for ruby (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:32485
    P
    		PolicyKit on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:31795
    P
    		Security update for MozillaFirefox, mozilla-nspr, mozilla-nss (Important)
    2020-12-01
    oval:org.opensuse.security:def:33486
    P
    		Security update for libpoppler
    2020-12-01
    oval:org.opensuse.security:def:26510
    P
    		Security update for nextcloud (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:27241
    P
    		mono-core on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25804
    P
    		Security update for the Linux Kernel (Important)
    2020-12-01
    oval:org.opensuse.security:def:26272
    P
    		Security update for openexr (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26609
    P
    		libxslt on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:27344
    P
    		libcurl4-openssl1-32bit on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25931
    P
    		Security update for libcares2 (Low)
    2020-12-01
    oval:org.opensuse.security:def:26784
    P
    		mono-core on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26930
    P
    		kernel-default on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26358
    P
    		Security update for Mozilla Thunderbird (Important)
    2020-12-01
    oval:org.opensuse.security:def:27662
    P
    		Security update for Ruby On Rails
    2020-12-01
    oval:org.opensuse.security:def:27817
    P
    		Security update for libssh2
    2020-12-01
    oval:org.opensuse.security:def:27160
    P
    		kdenetwork4-filesharing on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:29745
    P
    		Security update for gcc48 (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:30482
    P
    		Security update for Mono
    2020-12-01
    oval:org.opensuse.security:def:29022
    P
    		Security update for ImageMagick (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:55003
    P
    		rpm-32bit on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:55654
    P
    		Security update for tiff (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:54324
    P
    		libvorbis0 on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:54897
    P
    		libnetpbm11 on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:32375
    P
    		Security update for tiff (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:32529
    P
    		gzip on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:31927
    P
    		Security update for giflib (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:33812
    P
    		Recommended update for ghostscript-library (Important)
    2020-12-01
    oval:org.opensuse.security:def:26369
    P
    		Security update for Chromium (Important)
    2020-12-01
    oval:org.opensuse.security:def:26524
    P
    		apache2-mod_php5 on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25868
    P
    		Security update for pcre (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26356
    P
    		Security update for chromium (Important)
    2020-12-01
    oval:org.opensuse.security:def:26648
    P
    		wget on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:27379
    P
    		bytefx-data-mysql on GA media (Moderate)
    2020-12-01
    oval:org.mitre.oval:def:17863
    P
    		USN-1517-1 -- mono vulnerabilities
    2014-06-30
    oval:org.mitre.oval:def:20016
    P
    		DSA-2512-1 mono - missing input sanitising
    2014-06-23
    oval:org.opensuse.security:def:79831
    P
    		Security update for Mono
    2012-07-13
    oval:com.ubuntu.precise:def:20123382000
    V
    		CVE-2012-3382 on Ubuntu 12.04 LTS (precise) - medium.
    2012-07-12
    BACK
    mono mono *
    mono mono 2.6.7