CVE-2008-3842
medium · 4.3Request Validation (aka the ValidateRequest filters) in ASP.NET in Microsoft .NET Framework without the MS07-040 update does not properly detect dangerous client input, which allows remote attackers to conduct cross-site scripting (XSS) attacks, as demonstrated by a query string containing a "</" (less-than slash) sequence.
4.3
CVSS
20.4%
EPSS (exploit prob.)
97th
EPSS percentile
2008-08-27
Published
AV:N/AC:M/Au:N/C:N/I:P/A:N
Weaknesses
CWE-79
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| microsoft | windows-nt | 2003 |
| microsoft | windows-nt | 2003 |
| microsoft | windows-nt | 2003 |
| microsoft | windows-nt | 2003 |
| microsoft | windows-nt | 2003 |
| microsoft | windows-nt | 2003 |
| microsoft | windows-nt | xp |
| microsoft | windows-nt | xp |
| microsoft | windows_2000 | all versions |
| microsoft | windows_vista | all versions |
| microsoft | windows_xp | all versions |
| microsoft | windows_xp | all versions |
| microsoft | .net_framework | 2.0 |
| microsoft | windows-nt | 2003 |
| microsoft | windows-nt | 2003 |
| microsoft | windows-nt | 2003 |
| microsoft | windows-nt | 2003 |
| microsoft | windows-nt | 2003 |
| microsoft | windows-nt | 2003 |
| microsoft | windows-nt | 2008 |
| microsoft | windows-nt | 2008 |
| microsoft | windows-nt | 2008 |
| microsoft | windows-nt | xp |
| microsoft | windows-nt | xp |
| microsoft | windows_2000 | all versions |
| microsoft | windows_vista | all versions |
| microsoft | windows_xp | all versions |
| microsoft | windows_xp | all versions |
| microsoft | .net_framework | 1.1 |
| microsoft | windows-nt | 2003 |
| microsoft | windows-nt | 2003 |
| microsoft | windows-nt | 2003 |
| microsoft | windows-nt | 2003 |
| microsoft | windows-nt | 2003 |
| microsoft | windows-nt | 2003 |
| microsoft | windows-nt | 2008 |
| microsoft | windows-nt | xp |
| microsoft | windows-nt | xp |
| microsoft | windows-nt | xp |
| microsoft | windows-nt | xp |
Check a specific version with /api/v1/cve/match.
References
- http://securityreason.com/securityalert/4193
- http://www.procheckup.com/PDFs/bypassing-dot-NET-ValidateRequest.pdf
- http://www.securityfocus.com/archive/1/495667/100/0/threaded
- https://exchange.xforce.ibmcloud.com/vulnerabilities/44741
- http://securityreason.com/securityalert/4193
- http://www.procheckup.com/PDFs/bypassing-dot-NET-ValidateRequest.pdf
- http://www.securityfocus.com/archive/1/495667/100/0/threaded
- https://exchange.xforce.ibmcloud.com/vulnerabilities/44741
Query this programmatically:
curl https://evil-db.io/api/v1/cve/CVE-2008-3842