NVD

Id
3705  
Name
CVE-2008-3843  
Description
Request Validation (aka the ValidateRequest filters) in ASP.NET in Microsoft .NET Framework with the MS07-040 update does not properly detect dangerous client input, which allows remote attackers to conduct cross-site scripting (XSS) attacks, as demonstrated by a query string containing a "<~/" (less-than tilde slash) sequence followed by a crafted STYLE element.  
Reject
 
CVSS Version
2  
CVSS Score
4.3  
Severity
Medium  
CVSS Base Score
4.3  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:N/I:P/A:N)  
Pub Date
2017-01-03  
Published
2008-08-27  
Modified Date
2009-08-15  
Seq
2008-3843  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
23463 3705 CVE-2008-3843 4193  View
23464 3705 CVE-2008-3843 http://www.procheckup.com/PDFs/bypassing-dot-NET-ValidateRequest.pdf  View
23465 3705 CVE-2008-3843 http://www.procheckup.com/Vulnerability_PR08-20.php  View
23466 3705 CVE-2008-3843 20080821 PR08-20: Bypassing ASP .NET "ValidateRequest" for Script Injection Attacks  View
23467 3705 CVE-2008-3843 20080908 Re: [WEB SECURITY] PR08-20: Bypassing ASP .NET "ValidateRequest" for Script Injection Attacks  View
23468 3705 CVE-2008-3843 asp-validaterequestfilter-xss(44743)  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
49488 JVNDB-2008-004798 Microsoft .NET Framework の ASP.NET のリクエスト検証におけるクロスサイトスクリプティング攻撃を実行される脆弱性 Microsoft .NET Framework の ASP.NET の検証リクエストは、MS07-040 更新未対応の際、危険なクライアント入力を適切に検知しないため、クロスサイトスクリプティング攻撃を実行される脆弱性が存在します。 CVE-2008-3843 33956 CVE-2008-3843 3705 4.3 http://jvndb.jvn.jp/ja/contents/2008/JVNDB-2008-004798.html 2008-08-27 2012-09-25 View