CVE:CVE-2010-2480
CNNVD:CNNVD-201007-001
mako是SQLAlchemy开源的一个用 Python 编写的模板库。提供了一种熟悉的非 XML 语法，可编译成 Python 模块以获得最佳性能。
mako 0.3.4之前版本存在跨站脚本漏洞, 远程攻击者可以很容易的通过包含单引号字符和用于Body元素的JavaScript加载事件处理器的向量制造XSS攻击。
solution:Upgrade makotemplates mako to a higher version than 0.3.3,0.1.0,0.1.1,0.1.2,0.1.3,0.1.4,0.1.5,0.1.6,0.1.7,0.1.8,0.1.9,0.1.10,0.2.0,0.2.1,0.2.2,0.2.3,0.2.4,0.2.5,0.2.6,0.3,0.3.1,0.3.2,and avoid the version (,0.3.3],0.1.0,0.1.1,0.1.2,0.1.3,0.1.4,0.1.5,0.1.6,0.1.7,0.1.8,0.1.9,0.1.10,0.2.0,0.2.1,0.2.2,0.2.3,0.2.4,0.2.5,0.2.6,0.3,0.3.1,0.3.2