PT-2010-3698 · Microsoft · .Net Framework+1

Publicado 2010-05-27 · Atualizado 2010-05-28 · CVE-2010-2088

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Microsoft .NET versions prior to 3.5 with ASP.NET

Description The issue is related to the improper handling of an unencrypted view state in ASP.NET, allowing remote attackers to conduct cross-site scripting (XSS) attacks. This is achieved by exploiting the VIEWSTATE parameter in the form control.

Recommendations For Microsoft .NET versions prior to 3.5 with ASP.NET, consider encrypting the view state to prevent exploitation. As a temporary workaround, restrict access to the form control that utilizes the VIEWSTATE parameter until a proper fix is applied.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2010-2088

Produtos afetados

.Net Framework

Asp.Net

Referências · 4

• 🔥 http://blackhat.com/presentations/bh-dc-10/Byrne_David/BlackHat-DC-2010-Byrne-SGUI-slides.pdf · Exploit
• 🔥 https://trustwave.com/spiderlabs/advisories/TWSL2010-001.txt · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2010-2088 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2088 · Nota