Описание
Request Validation (aka the ValidateRequest filters) in ASP.NET in Microsoft .NET Framework without the MS07-040 update does not properly detect dangerous client input, which allows remote attackers to conduct cross-site scripting (XSS) attacks, as demonstrated by a query string containing a "</" (less-than slash) sequence.
Ссылки
- Third Party Advisory
- Broken Link
- Third Party Advisory
- Broken Link
Уязвимые конфигурации
Конфигурация 1
Одновременно
Одно из
cpe:2.3:o:microsoft:windows-nt:2003:gold:server_x64:*:*:*:*:*
cpe:2.3:o:microsoft:windows-nt:2003:sp1:server:*:*:*:*:*
cpe:2.3:o:microsoft:windows-nt:2003:sp1:server_itanium:*:*:*:*:*
cpe:2.3:o:microsoft:windows-nt:2003:sp2:server:*:*:*:*:*
cpe:2.3:o:microsoft:windows-nt:2003:sp2:server_itanium:*:*:*:*:*
cpe:2.3:o:microsoft:windows-nt:2003:sp2:server_x64:*:*:*:*:*
cpe:2.3:o:microsoft:windows-nt:xp:gold:x64:*:*:*:*:*
cpe:2.3:o:microsoft:windows-nt:xp:sp3:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_2000:*:sp4:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_vista:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_xp:*:sp2:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_xp:*:sp2:x64:*:*:*:*:*
cpe:2.3:a:microsoft:.net_framework:2.0:*:*:*:*:*:*:*
Конфигурация 2
Одновременно
Одно из
cpe:2.3:o:microsoft:windows-nt:2003:gold:server_x64:*:*:*:*:*
cpe:2.3:o:microsoft:windows-nt:2003:sp1:server:*:*:*:*:*
cpe:2.3:o:microsoft:windows-nt:2003:sp1:server_itanium:*:*:*:*:*
cpe:2.3:o:microsoft:windows-nt:2003:sp2:server:*:*:*:*:*
cpe:2.3:o:microsoft:windows-nt:2003:sp2:server_itanium:*:*:*:*:*
cpe:2.3:o:microsoft:windows-nt:2003:sp2:server_x64:*:*:*:*:*
cpe:2.3:o:microsoft:windows-nt:2008:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows-nt:2008:*:itanium:*:*:*:*:*
cpe:2.3:o:microsoft:windows-nt:2008:*:x64:*:*:*:*:*
cpe:2.3:o:microsoft:windows-nt:xp:gold:x64:*:*:*:*:*
cpe:2.3:o:microsoft:windows-nt:xp:sp3:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_2000:*:sp4:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_vista:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_xp:*:sp2:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_xp:*:sp2:x64:*:*:*:*:*
cpe:2.3:a:microsoft:.net_framework:1.1:sp1:*:*:*:*:*:*
Конфигурация 3
Одновременно
Одно из
cpe:2.3:o:microsoft:windows-nt:2003:gold:server_x64:*:*:*:*:*
cpe:2.3:o:microsoft:windows-nt:2003:sp1:server:*:*:*:*:*
cpe:2.3:o:microsoft:windows-nt:2003:sp1:server_itanium:*:*:*:*:*
cpe:2.3:o:microsoft:windows-nt:2003:sp2:server:*:*:*:*:*
cpe:2.3:o:microsoft:windows-nt:2003:sp2:server_itanium:*:*:*:*:*
cpe:2.3:o:microsoft:windows-nt:2003:sp2:server_x64:*:*:*:*:*
cpe:2.3:o:microsoft:windows-nt:2008:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows-nt:xp:gold:media_center_2005:*:*:*:*:*
cpe:2.3:o:microsoft:windows-nt:xp:gold:tablet_pc_2005:*:*:*:*:*
cpe:2.3:o:microsoft:windows-nt:xp:gold:x64:*:*:*:*:*
cpe:2.3:o:microsoft:windows-nt:xp:sp3:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_2000:*:sp4:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_vista:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_xp:*:sp2:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_xp:*:sp2:x64:*:*:*:*:*
cpe:2.3:a:microsoft:.net_framework:1.0:sp3:*:*:*:*:*:*
EPSS
Процентиль: 93%
0.11493
Средний
4.3 Medium
CVSS2
Дефекты
CWE-79
Связанные уязвимости
github
почти 4 года назад
Request Validation (aka the ValidateRequest filters) in ASP.NET in Microsoft .NET Framework without the MS07-040 update does not properly detect dangerous client input, which allows remote attackers to conduct cross-site scripting (XSS) attacks, as demonstrated by a query string containing a "</" (less-than slash) sequence.
EPSS
Процентиль: 93%
0.11493
Средний
4.3 Medium
CVSS2
Дефекты
CWE-79