CVE-2010-2480

Mako before 0.3.4 relies on the cgi.escape function in the Python standard library for cross-site scripting (XSS) protection, which makes it easier for remote attackers to conduct XSS attacks via vectors involving single-quote characters and a JavaScript onLoad event handler for a BODY element.

Published: Jul 2, 2010
Updated: May 9, 2024
CVE: CVE-2010-2480
GHSA: GHSA-7q8x-38mc-p84f
Severity: Low
Exploit:

CVSS v2:

Severity: Low
Score: 4.3
AV:N/AC:M/Au:N/C:N/I:P/A:N

CWEs:

CWE-79

OWASP TOP 10:

A7 - Cross-Site Scripting (XSS)

Affected Software
References

Software	From	Fixed in
makotemplates / mako	0.2.3	0.2.3.x
makotemplates / mako	0.1.3	0.1.3.x
makotemplates / mako	0.2.2	0.2.2.x
makotemplates / mako	0.1.2	0.1.2.x
makotemplates / mako	0.1.9	0.1.9.x
makotemplates / mako	0.3.2	0.3.2.x
makotemplates / mako	0.2.4	0.2.4.x
makotemplates / mako	0.1.10	0.1.10.x
makotemplates / mako	0.1.8	0.1.8.x
makotemplates / mako	0.1.5	0.1.5.x
makotemplates / mako	0.1.0	0.1.0.x
makotemplates / mako	0.2.5	0.2.5.x
makotemplates / mako	0.3	0.3.x
makotemplates / mako	0.1.7	0.1.7.x
makotemplates / mako	0.3.1	0.3.1.x
makotemplates / mako	0.2.0	0.2.0.x
makotemplates / mako	0.1.4	0.1.4.x
makotemplates / mako	0.2.1	0.2.1.x
makotemplates / mako	0.1.6	0.1.6.x
makotemplates / mako	0.2.6	0.2.6.x
makotemplates / mako	-	0.3.3.x
makotemplates / mako	0.1.1	0.1.1.x
mako	-	0.3.4

Vulnerability Database

CVE-2010-2480