CVE-2011-3416
The Forms Authentication feature in the ASP.NET subsystem in Microsoft .NET Framework 1.1 SP1, 2.0 SP2, 3.5 SP1, 3.5.1, and 4.0 allows remote authenticated users to obtain access to arbitrary user accounts via a crafted username, aka "ASP.Net Forms…
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 43.7%, higher than 99% of all known CVEs. Patch or mitigate before the next change window.
Description
The Forms Authentication feature in the ASP.NET subsystem in Microsoft .NET Framework 1.1 SP1, 2.0 SP2, 3.5 SP1, 3.5.1, and 4.0 allows remote authenticated users to obtain access to arbitrary user accounts via a crafted username, aka "ASP.Net Forms Authentication Bypass Vulnerability."
- CVSS 2.0
- 8.5 HIGHAV:N/AC:M/Au:S/C:C/I:C/A:C
- EPSS
- 43.69% probability · 99th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-264
- Affected
- microsoft/windows 7 · microsoft/windows server 2003 · microsoft/windows server 2008 · microsoft/windows vista · microsoft/windows xp
- Source
- secure@microsoft.com
References
- http://www.us-cert.gov/cas/techalerts/TA11-347A.htmlUS Government Resource
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-100
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14363
- http://www.us-cert.gov/cas/techalerts/TA11-347A.htmlUS Government Resource
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-100
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14363
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.