Description
The Forms Authentication feature in the ASP.NET subsystem in Microsoft .NET Framework 1.1 SP1, 2.0 SP2, 3.5 SP1, 3.5.1, and 4.0 allows remote authenticated users to obtain access to arbitrary user accounts via a crafted username, aka "ASP.Net Forms Authentication Bypass Vulnerability."
References (3)
Core 3
Core References
Third Party Advisory, VDB Entry vdb-entry
signature
x_refsource_oval
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14363
US Government Resource third-party-advisory
x_refsource_cert
http://www.us-cert.gov/cas/techalerts/TA11-347A.html
Vendor Advisory vendor-advisory
x_refsource_ms
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-100
Scores
EPSS
0.4558
EPSS Percentile
98.7%
Details
CWE
CWE-264
Status
published
Products (7)
microsoft/windows_7
(3 CPE variants)
microsoft/windows_server_2003
microsoft/windows_server_2008
(4 CPE variants)
microsoft/windows_server_2008
r2
microsoft/windows_vista
(2 CPE variants)
microsoft/windows_xp
microsoft/windows_xp
sp3 unknown
Published
Dec 30, 2011
Tracked Since
Feb 18, 2026