CVE-2005-0452

Multiple cross-site scripting (XSS) vulnerabilities in Microsoft ASP.NET (.Net) 1.0 and 1.1 to SP1 allow remote attackers to inject arbitrary HTML or web script via Unicode representations for ASCII fullwidth characters that are converted to normal ASCII characters, including ">" and "<".

CVSS v2.0 4.3 MEDIUM

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://it-project.ru/andir/docs/aspxvuln/aspxvuln.en.xml	Vendor Advisory
http://marc.info/?l=bugtraq&m=110867912714913&w=2
http://secunia.com/advisories/14214	Vendor Advisory
http://www.securityfocus.com/bid/12574	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:microsoft:asp.net:1.0:::::::*
	cpe:2.3:a:microsoft:asp.net:1.0:sp1::::::
	cpe:2.3:a:microsoft:asp.net:1.0:sp2::::::
	cpe:2.3:a:microsoft:asp.net:1.1:::::::*
	cpe:2.3:a:microsoft:asp.net:1.1:sp1::::::

History

No history.

Information

Published : 2005-02-16 05:00

Updated : 2024-02-28 10:42

NVD link : CVE-2005-0452

Mitre link : CVE-2005-0452

CVE.ORG link : CVE-2005-0452

JSON object : View

Products Affected

microsoft

asp.net

CWE

NVD-CWE-Other

{"id": "CVE-2005-0452", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2005-02-16T05:00:00.000", "references": [{"url": "http://it-project.ru/andir/docs/aspxvuln/aspxvuln.en.xml", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://marc.info/?l=bugtraq&m=110867912714913&w=2", "source": "cve@mitre.org"}, {"url": "http://secunia.com/advisories/14214", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/12574", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "Multiple cross-site scripting (XSS) vulnerabilities in Microsoft ASP.NET (.Net) 1.0 and 1.1 to SP1 allow remote attackers to inject arbitrary HTML or web script via Unicode representations for ASCII fullwidth characters that are converted to normal ASCII characters, including \">\" and \"<\"."}], "lastModified": "2016-10-18T03:11:45.100", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:microsoft:asp.net:1.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "23853366-133E-40D0-9CD5-9995A642728F"}, {"criteria": "cpe:2.3:a:microsoft:asp.net:1.0:sp1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CA932DEC-C465-45A7-860C-4217D72EDCAA"}, {"criteria": "cpe:2.3:a:microsoft:asp.net:1.0:sp2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FCCD7252-375C-44AC-9761-C14723B8AFF8"}, {"criteria": "cpe:2.3:a:microsoft:asp.net:1.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D1D8B732-4FC7-4454-9F94-B1C99952462A"}, {"criteria": "cpe:2.3:a:microsoft:asp.net:1.1:sp1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CC441C4B-3A1E-4709-8601-44477A6D5FA0"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}