CVE-2010-1459 [Medium]

The default configuration of ASP.NET in Mono before 2.6.4 has a value of FALSE for the EnableViewStateMac property, which allows remote attackers to conduct cross-site scripting (XSS) attacks, as demonstrated by the __VIEWSTATE parameter to 2.0/menu/menu1.aspx in the XSP sample project.

#	Date	Old EPSS score	New EPSS score	Delta (New - Old)
1	2025-03-30	0.97%	0.41%	-0.56%
2	2025-03-29	0.36%	0.97%	+0.61%
3	2023-03-07	—	0.36%	—

Date

Old EPSS score

New EPSS score

Delta (New - Old)

2025-03-30

0.97%

0.41%

-0.56%

2025-03-29

0.36%

0.97%

+0.61%

2023-03-07

—

0.36%

—

Base score	Version	Severity	Vector	Exploitability	Impact	Score source
4.3	2.0	MEDIUM	`AV:N/AC:M/Au:N/C:N/I:P/A:N` Click to expand Access vector (AV:N) Can be exploited remotely over network reachability. Access complexity (AC:M) Exploitation needs some favorable conditions, but not exceptional ones. Authentication (AU:N) No authentication is required. Confidentiality impact (C:N) No confidentiality impact. Integrity impact (I:P) Partial integrity impact. Availability impact (A:N) No availability impact.	8.6	2.9	[email protected]

Base score

Version

Severity

Vector

Exploitability

Impact

Score source

4.3

2.0

MEDIUM

AV:N/AC:M/Au:N/C:N/I:P/A:N Click to expand

Access vector (AV:N): Can be exploited remotely over network reachability.
Access complexity (AC:M): Exploitation needs some favorable conditions, but not exceptional ones.
Authentication (AU:N): No authentication is required.
Confidentiality impact (C:N): No confidentiality impact.
Integrity impact (I:P): Partial integrity impact.
Availability impact (A:N): No availability impact.

8.6

2.9

[email protected]

OS Trackers for CVE-2010-1459

vendor	priority	summary	link
`debian`	not yet assigned	CVE-2010-1459 not yet assigned priority: Debian including 1 source packages (mono), 5 status rows across 5 suites (bookworm, bullseye, forky, sid, trixie): resolved 5.	https://security-tracker.debian.org/tracker/CVE-2010-1459
`redhat`	medium	—	https://access.redhat.com/security/cve/CVE-2010-1459
`ubuntu`	low	CVE-2010-1459 low priority: Ubuntu including 1 source packages (mono), 10 status rows across 10 suites (dapper, hardy, jaunty, karmic, lucid, maverick, natty, oneiric, precise, upstream): ignored 4, not-affected 4, released 2.	https://ubuntu.com/security/CVE-2010-1459

Affected software / configurations for CVE-2010-1459

Vendor	Product	Version	Raw CPE
mono	mono	1.0	cpe:2.3:a:mono:mono:1.0:::::::*
mono	mono	1.0.1	cpe:2.3:a:mono:mono:1.0.1:::::::*
mono	mono	1.0.2	cpe:2.3:a:mono:mono:1.0.2:::::::*
mono	mono	1.0.4	cpe:2.3:a:mono:mono:1.0.4:::::::*
mono	mono	1.0.5	cpe:2.3:a:mono:mono:1.0.5:::::::*
mono	mono	1.0.6	cpe:2.3:a:mono:mono:1.0.6:::::::*
mono	mono	1.1.1	cpe:2.3:a:mono:mono:1.1.1:::::::*
mono	mono	1.1.2	cpe:2.3:a:mono:mono:1.1.2:::::::*
mono	mono	1.1.3	cpe:2.3:a:mono:mono:1.1.3:::::::*
mono	mono	1.1.4	cpe:2.3:a:mono:mono:1.1.4:::::::*
mono	mono	1.1.5	cpe:2.3:a:mono:mono:1.1.5:::::::*
mono	mono	1.1.6	cpe:2.3:a:mono:mono:1.1.6:::::::*
mono	mono	1.1.7	cpe:2.3:a:mono:mono:1.1.7:::::::*
mono	mono	1.1.8	cpe:2.3:a:mono:mono:1.1.8:::::::*
mono	mono	1.1.8.1	cpe:2.3:a:mono:mono:1.1.8.1:::::::*
mono	mono	1.1.8.3	cpe:2.3:a:mono:mono:1.1.8.3:::::::*
mono	mono	1.1.9	cpe:2.3:a:mono:mono:1.1.9:::::::*
mono	mono	1.1.9.1	cpe:2.3:a:mono:mono:1.1.9.1:::::::*
mono	mono	1.1.9.2	cpe:2.3:a:mono:mono:1.1.9.2:::::::*
mono	mono	1.1.10	cpe:2.3:a:mono:mono:1.1.10:::::::*
mono	mono	1.1.10.1	cpe:2.3:a:mono:mono:1.1.10.1:::::::*
mono	mono	1.1.11	cpe:2.3:a:mono:mono:1.1.11:::::::*
mono	mono	1.1.12	cpe:2.3:a:mono:mono:1.1.12:::::::*
mono	mono	1.1.12.1	cpe:2.3:a:mono:mono:1.1.12.1:::::::*
mono	mono	1.1.13	cpe:2.3:a:mono:mono:1.1.13:::::::*
mono	mono	1.1.13.2	cpe:2.3:a:mono:mono:1.1.13.2:::::::*
mono	mono	1.1.13.4	cpe:2.3:a:mono:mono:1.1.13.4:::::::*
mono	mono	1.1.13.5	cpe:2.3:a:mono:mono:1.1.13.5:::::::*
mono	mono	1.1.13.6	cpe:2.3:a:mono:mono:1.1.13.6:::::::*
mono	mono	1.1.13.7	cpe:2.3:a:mono:mono:1.1.13.7:::::::*
mono	mono	1.1.13.8	cpe:2.3:a:mono:mono:1.1.13.8:::::::*
mono	mono	1.1.13.8.1	cpe:2.3:a:mono:mono:1.1.13.8.1:::::::*
mono	mono	1.1.14	cpe:2.3:a:mono:mono:1.1.14:::::::*
mono	mono	1.1.15	cpe:2.3:a:mono:mono:1.1.15:::::::*
mono	mono	1.1.16	cpe:2.3:a:mono:mono:1.1.16:::::::*
mono	mono	1.1.16.1	cpe:2.3:a:mono:mono:1.1.16.1:::::::*
mono	mono	1.1.17	cpe:2.3:a:mono:mono:1.1.17:::::::*
mono	mono	1.1.17.1	cpe:2.3:a:mono:mono:1.1.17.1:::::::*
mono	mono	1.1.17.2	cpe:2.3:a:mono:mono:1.1.17.2:::::::*
mono	mono	1.1.18	cpe:2.3:a:mono:mono:1.1.18:::::::*
mono	mono	1.2	cpe:2.3:a:mono:mono:1.2:::::::*
mono	mono	1.2.1	cpe:2.3:a:mono:mono:1.2.1:::::::*
mono	mono	1.2.2	cpe:2.3:a:mono:mono:1.2.2:::::::*
mono	mono	1.2.2.1	cpe:2.3:a:mono:mono:1.2.2.1:::::::*
mono	mono	1.2.3	cpe:2.3:a:mono:mono:1.2.3:::::::*
mono	mono	1.2.3.1	cpe:2.3:a:mono:mono:1.2.3.1:::::::*
mono	mono	1.2.4	cpe:2.3:a:mono:mono:1.2.4:::::::*
mono	mono	1.2.5	cpe:2.3:a:mono:mono:1.2.5:::::::*
mono	mono	1.2.5.1	cpe:2.3:a:mono:mono:1.2.5.1:::::::*
mono	mono	1.2.5.2	cpe:2.3:a:mono:mono:1.2.5.2:::::::*
mono	mono	1.2.6	cpe:2.3:a:mono:mono:1.2.6:::::::*
mono	mono	1.9	cpe:2.3:a:mono:mono:1.9:::::::*
mono	mono	1.9.1	cpe:2.3:a:mono:mono:1.9.1:::::::*
mono	mono	2.0	cpe:2.3:a:mono:mono:2.0:::::::*
mono	mono	2.0.1	cpe:2.3:a:mono:mono:2.0.1:::::::*
mono	mono	2.2	cpe:2.3:a:mono:mono:2.2:::::::*
mono	mono	2.4	cpe:2.3:a:mono:mono:2.4:::::::*
mono	mono	2.4.2	cpe:2.3:a:mono:mono:2.4.2:::::::*
mono	mono	2.4.2.1	cpe:2.3:a:mono:mono:2.4.2.1:::::::*
mono	mono	2.4.2.2	cpe:2.3:a:mono:mono:2.4.2.2:::::::*
mono	mono	2.4.2.3	cpe:2.3:a:mono:mono:2.4.2.3:::::::*
mono	mono	2.4.3	cpe:2.3:a:mono:mono:2.4.3:::::::*

References for CVE-2010-1459

URL	Tags
http://lists.opensuse.org/opensuse-security-announce/2010-05/msg00002.html
http://lists.opensuse.org/opensuse-security-announce/2010-06/msg00001.html
http://lists.opensuse.org/opensuse-security-announce/2010-08/msg00001.html
http://www.communities.hp.com/securitysoftware/blogs/spilabs/archive/2010/04/29/asp-net-cross-site-scripting-followup-mono.aspx
http://www.mono-project.com/Vulnerabilities#ASP.NET_View_State_Cross-Site_Scripting	Vendor Advisory
http://www.securityfocus.com/bid/40351

URL

CVE-2010-1459

Exploit prediction scoring system (EPSS) score for CVE-2010-1459

Common vulnerability scoring system (CVSS) metrics for CVE-2010-1459

Weakness enumeration for CVE-2010-1459

GitHub Security Advisory for CVE-2010-1459

OS Trackers for CVE-2010-1459

Affected software / configurations for CVE-2010-1459

References for CVE-2010-1459