CVE-2008-3842
.NET Framework - Cross-Site Scripting via ValidateRequest Bypass
Title source: llmDescription
Request Validation (aka the ValidateRequest filters) in ASP.NET in Microsoft .NET Framework without the MS07-040 update does not properly detect dangerous client input, which allows remote attackers to conduct cross-site scripting (XSS) attacks, as demonstrated by a query string containing a "</" (less-than slash) sequence.
References (4)
Core 4
Core References
Broken Link x_refsource_misc
http://www.procheckup.com/PDFs/bypassing-dot-NET-ValidateRequest.pdf
Third Party Advisory third-party-advisory
x_refsource_sreason
http://securityreason.com/securityalert/4193
Third Party Advisory, VDB Entry vdb-entry
x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/44741
Third Party Advisory, VDB Entry mailing-list
x_refsource_bugtraq
http://www.securityfocus.com/archive/1/495667/100/0/threaded
Scores
EPSS
0.2042
EPSS Percentile
97.2%
Details
CWE
CWE-79
Status
published
Products (3)
microsoft/.net_framework
2.0
microsoft/.net_framework
1.1 sp1
microsoft/.net_framework
1.0 sp3
Published
Aug 27, 2008
Tracked Since
Feb 18, 2026