CVE-2010-2477

Published: 06/11/2010 Updated: 10/12/2010

CVSS v2 Base Score: 4.3 | Impact Score: 2.9 | Exploitability Score: 8.6

VMScore: 383

Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N

Multiple cross-site scripting (XSS) vulnerabilities in the paste.httpexceptions implementation in Paste prior to 1.7.4 allow remote malicious users to inject arbitrary web script or HTML via vectors involving a 404 status code, related to (1) paste.urlparser.StaticURLParser, (2) paste.urlparser.PkgResourcesParser, (3) paste.urlmap.URLMap, and (4) HTTPNotFound.

Vulnerable Product	Search on Vulmon	Subscribe to Product
pythonpaste paste
pythonpaste paste 1.4.2
pythonpaste paste 1.4
pythonpaste paste 0.9.2
pythonpaste paste 0.9.1
pythonpaste paste 1.7.3
pythonpaste paste 1.7.2
pythonpaste paste 1.3
pythonpaste paste 1.2
pythonpaste paste 0.5
pythonpaste paste 0.4.1
pythonpaste paste 1.7.1
pythonpaste paste 1.7
pythonpaste paste 1.1.1
pythonpaste paste 1.1
pythonpaste paste 0.1.0
pythonpaste paste 0.3
pythonpaste paste 1.6
pythonpaste paste 1.5
pythonpaste paste 1.0.1
pythonpaste paste 0.9.4
pythonpaste paste 0.9.3

It was discovered that Python Paste did not properly sanitize certain strings, resulting in cross-site scripting (XSS) vulnerabilities With cross-site scripting vulnerabilities, if a user were tricked into viewing server output during a crafted server request, a remote attacker could exploit this to modify the contents, or steal confidential data, ...

CWE-79 http://pylonshq.com/articles/archives/2010/6/paste_174_released_addresses_xss_security_hole http://groups.google.com/group/pylons-discuss/msg/8c256dc076a408d8?dmode=source&output=gplain http://marc.info/?l=oss-security&m=127792576822169&w=2 http://marc.info/?l=oss-security&m=127785414818815&w=2 http://bitbucket.org/ianb/paste/changeset/fcae59df8b56 http://secunia.com/advisories/42500 http://www.securityfocus.com/bid/41160 http://groups.google.com/group/paste-users/browse_thread/thread/3b3fff3dadd0b1e5?pli=1 http://www.ubuntu.com/usn/USN-1026-1 https://usn.ubuntu.com/1026-1/https://nvd.nist.gov

CVE-2010-2477

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect