Mako before 0.3.4 relies on the cgi.escape function in the Python standard library for cross-site scripting (XSS) protection, which makes it easier for remote attackers to conduct XSS attacks via vectors involving single-quote characters and a JavaScript onLoad event handler for a BODY element.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Mako before 0.3.4 relies on the cgi.escape function in the Python standard library for cross-site
    scripting (XSS) protection, which makes it easier for remote attackers to conduct XSS attacks via vectors
    involving single-quote characters and a JavaScript onLoad event handler for a BODY element.
    (CVE-2010-2480)

Python-mako was prone to a Cross-Site Scripting flaw due to improperly escaped single quotes (CVE-2010-2480).

It was discovered that Mako incorrectly filtered single-quote characters when performing html filtering. An attacker could utilize this to perform cross-site scripting attacks.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Type	Severity
412200	SCA: security update for mako (GHSA-7q8x-38mc-p84f)	Tenable Cloud Security	SCA Checks	Local	medium
412200	SCA: security update for mako (GHSA-7q8x-38mc-p84f)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
75720	openSUSE Security Update : python-mako (openSUSE-SU-2010:0383-1)	Nessus	SuSE Local Security Checks	Local	medium
49765	Ubuntu 10.04 LTS : mako vulnerability (USN-996-1)	Nessus	Ubuntu Local Security Checks	Local	medium
47758	openSUSE Security Update : python-mako (openSUSE-SU-2010:0383-1)	Nessus	SuSE Local Security Checks	Local	medium

Detections

Analytics

CVE-2010-2480

medium

Tenable Plugins

medium

medium

medium

medium

medium