CVE-2008-3843

Microsoft .NET Framework - Cross-Site Scripting via ValidateRequest Bypass

Title source: llm
STIX 2.1

Description

Request Validation (aka the ValidateRequest filters) in ASP.NET in Microsoft .NET Framework with the MS07-040 update does not properly detect dangerous client input, which allows remote attackers to conduct cross-site scripting (XSS) attacks, as demonstrated by a query string containing a "<~/" (less-than tilde slash) sequence followed by a crafted STYLE element.

References (6)

Core 6
Core References
Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/496071/100/0/threaded
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/44743
Third Party Advisory third-party-advisory x_refsource_sreason
http://securityreason.com/securityalert/4193
Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/495667/100/0/threaded
Various Sources x_refsource_misc
http://www.procheckup.com/Vulnerability_PR08-20.php

Scores

EPSS 0.2199
EPSS Percentile 97.4%

Details

CWE
CWE-79
Status published
Products (3)
microsoft/.net_framework 1.0 sp3
microsoft/.net_framework 1.1 sp1
microsoft/.net_framework 2.0
Published Aug 27, 2008
Tracked Since Feb 18, 2026