CVE-2004-0847 The Microsoft .NET forms authentication capability for ASP.NET allows remote attackers to bypass authentication for .aspx files in restricted directories via a request containing a (1) "" (backslash)....
CriticalCVSS 9.8
EPSS 75.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The Microsoft .NET forms authentication capability for ASP.NET allows remote attackers to bypass authentication for .aspx files in restricted directories via a request containing a (1) "" (backslash) or (2) "%5C" (encoded backslash), aka "Path Validation Vulnerability."
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Microsoft asp.net | <= 1.1 | No fix listed |
| Microsoft asp.net | = 1.1-sp1 | No fix listed |
References
- 20040914 Security bug in .NET Forms Authentication exploit mailing-list vendor-advisory
- sourceforge.net broken-link
- VU#283646 third-party-advisory us-government-resource
- 11342 third-party-advisory vdb-entry
- TA05-039A third-party-advisory us-government-resource
- MS05-004 vendor-advisory
- windows-forms-security-bypass(17644) third-party-advisory vdb-entry
- oval:org.mitre.oval:def:3556 signature third-party-advisory vdb-entry
- oval:org.mitre.oval:def:4987 signature third-party-advisory vdb-entry