Description
The Forms Authentication feature in the ASP.NET subsystem in Microsoft .NET Framework 1.1 SP1, 2.0 SP2, 3.5 SP1, 3.5.1, and 4.0, when sliding expiry is enabled, does not properly handle cached content, which allows remote attackers to obtain access to arbitrary user accounts via a crafted URL, aka "ASP.NET Forms Authentication Ticket Caching Vulnerability."
References (4)
Core 4
Core References
US Government Resource third-party-advisory
x_refsource_cert
http://www.us-cert.gov/cas/techalerts/TA11-347A.html
Vendor Advisory vendor-advisory
x_refsource_ms
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-100
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/51203
Third Party Advisory, VDB Entry vdb-entry
signature
x_refsource_oval
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14625
Scores
EPSS
0.3573
EPSS Percentile
98.3%
Details
CWE
CWE-264
Status
published
Products (7)
microsoft/windows_7
(3 CPE variants)
microsoft/windows_server_2003
microsoft/windows_server_2008
(4 CPE variants)
microsoft/windows_server_2008
r2
microsoft/windows_vista
(2 CPE variants)
microsoft/windows_xp
microsoft/windows_xp
sp3 unknown
Published
Dec 30, 2011
Tracked Since
Feb 18, 2026