CVE-2010-2088

ASP.NET in Microsoft .NET 3.5 - Cross-Site Scripting via __VIEWSTATE Parameter

Title source: llm
STIX 2.1

Description

ASP.NET in Microsoft .NET 3.5 does not properly handle an unencrypted view state, which allows remote attackers to conduct cross-site scripting (XSS) attacks against the form control via the __VIEWSTATE parameter.

References (2)

Core 2

Scores

EPSS 0.0900
EPSS Percentile 94.8%

Details

CWE
CWE-79
Status published
Products (1)
microsoft/asp.net 3.5
Published May 27, 2010
Tracked Since Feb 18, 2026