Multiple cross-site scripting (XSS) vulnerabilities in the paste.httpexceptions implementation in Paste before 1.7.4 allow remote attackers to inject arbitrary web script or HTML via vectors involving a 404 status code, related to (1) paste.urlparser.StaticURLParser, (2) paste.urlparser.PkgResourcesParser, (3) paste.urlmap.URLMap, and (4) HTTPNotFound.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Multiple cross-site scripting (XSS) vulnerabilities in the paste.httpexceptions implementation in Paste
    before 1.7.4 allow remote attackers to inject arbitrary web script or HTML via vectors involving a 404
    status code, related to (1) paste.urlparser.StaticURLParser, (2) paste.urlparser.PkgResourcesParser, (3)
    paste.urlmap.URLMap, and (4) HTTPNotFound. (CVE-2010-2477)

It was discovered that Python Paste did not properly sanitize certain strings, resulting in cross-site scripting (XSS) vulnerabilities. With cross-site scripting vulnerabilities, if a user were tricked into viewing server output during a crafted server request, a remote attacker could exploit this to modify the contents, or steal confidential data, within the same domain.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
433065	SCA: security update for paste (GHSA-7gfc-2v6g-6w9f)	Tenable Cloud Security	SCA Checks	medium
433065	SCA: security update for paste (GHSA-7gfc-2v6g-6w9f)	Tenable Self-Hosted Container Security	SCA Checks	medium
51073	Ubuntu 10.04 LTS : paste vulnerability (USN-1026-1)	Nessus	Ubuntu Local Security Checks	medium

Detections

Analytics

CVE-2010-2477

medium

Tenable Plugins

medium

medium

medium