CVE-2008-3843 : Request Validation (aka the ValidateRequest filters) in ASP.NET in Microsoft .NE

Request Validation (aka the ValidateRequest filters) in ASP.NET in Microsoft .NET Framework with the MS07-040 update does not properly detect dangerous client input, which allows remote attackers to conduct cross-site scripting (XSS) attacks, as demonstrated by a query string containing a "<~/" (less-than tilde slash) sequence followed by a crafted STYLE element.

Published 2008-08-27 20:41:00

Updated 2018-10-30 16:25:57

Source MITRE

View at NVD, CVE.org

Vulnerability category: Cross site scripting (XSS)

Products affected by CVE-2008-3843

Microsoft » .net Framework » Version: 1.1 Update SP1
cpe:2.3:a:microsoft:.net_framework:1.1:sp1:*:*:*:*:*:*
Matching versions
When used together with: Microsoft » Windows-nt » Version: 2003 Update Gold Server X64 Edition
When used together with: Microsoft » Windows-nt » Version: 2003 Update SP1 Server Edition
When used together with: Microsoft » Windows-nt » Version: 2003 Update SP1 Server Itanium Edition
When used together with: Microsoft » Windows-nt » Version: 2003 Update SP2 Server Edition
When used together with: Microsoft » Windows-nt » Version: 2003 Update SP2 Server Itanium Edition
When used together with: Microsoft » Windows-nt » Version: 2003 Update SP2 Server X64 Edition
When used together with: Microsoft » Windows-nt » Version: 2008
When used together with: Microsoft » Windows-nt » Version: 2008 Itanium Edition
When used together with: Microsoft » Windows-nt » Version: 2008 X64 Edition
When used together with: Microsoft » Windows-nt » Version: Vista Update SP1 X64 Edition
When used together with: Microsoft » Windows-nt » Version: XP Update Gold X64 Edition
When used together with: Microsoft » Windows-nt » Version: XP Update SP3
When used together with: Microsoft » Windows 2000 » Update SP4
When used together with: Microsoft » Windows Vista
When used together with: Microsoft » Windows Vista » Update Gold X64 Edition
When used together with: Microsoft » Windows Vista » Version: N/A Update SP1
When used together with: Microsoft » Windows Xp » Update SP2
When used together with: Microsoft » Windows Xp » Update SP2 X64 Edition
Microsoft » .net Framework » Version: 2.0
cpe:2.3:a:microsoft:.net_framework:2.0:*:*:*:*:*:*:*
Matching versions
When used together with: Microsoft » Windows-nt » Version: 2003 Update Gold Server X64 Edition
When used together with: Microsoft » Windows-nt » Version: 2003 Update SP1 Server Edition
When used together with: Microsoft » Windows-nt » Version: 2003 Update SP1 Server Itanium Edition
When used together with: Microsoft » Windows-nt » Version: 2003 Update SP2 Server Edition
When used together with: Microsoft » Windows-nt » Version: 2003 Update SP2 Server Itanium Edition
When used together with: Microsoft » Windows-nt » Version: 2003 Update SP2 Server X64 Edition
When used together with: Microsoft » Windows-nt » Version: XP Update Gold X64 Edition
When used together with: Microsoft » Windows-nt » Version: XP Update SP3
When used together with: Microsoft » Windows 2000 » Update SP4
When used together with: Microsoft » Windows Vista
When used together with: Microsoft » Windows Vista » Update Gold X64 Edition
When used together with: Microsoft » Windows Xp » Update SP2
When used together with: Microsoft » Windows Xp » Update SP2 X64 Edition
Microsoft » .net Framework » Version: 1.0 Update SP3
cpe:2.3:a:microsoft:.net_framework:1.0:sp3:*:*:*:*:*:*
Matching versions
When used together with: Microsoft » Windows-nt » Version: 2003 Update Gold Server X64 Edition
When used together with: Microsoft » Windows-nt » Version: 2003 Update SP1 Server Edition
When used together with: Microsoft » Windows-nt » Version: 2003 Update SP1 Server Itanium Edition
When used together with: Microsoft » Windows-nt » Version: 2003 Update SP2 Server Edition
When used together with: Microsoft » Windows-nt » Version: 2003 Update SP2 Server Itanium Edition
When used together with: Microsoft » Windows-nt » Version: 2003 Update SP2 Server X64 Edition
When used together with: Microsoft » Windows-nt » Version: 2008
When used together with: Microsoft » Windows-nt » Version: XP Update Gold Media Center 2005 Edition
When used together with: Microsoft » Windows-nt » Version: XP Update Gold Tablet Pc 2005 Edition
When used together with: Microsoft » Windows-nt » Version: XP Update Gold X64 Edition
When used together with: Microsoft » Windows-nt » Version: XP Update SP3
When used together with: Microsoft » Windows 2000 » Update SP4
When used together with: Microsoft » Windows Vista
When used together with: Microsoft » Windows Vista » Version: N/A Update SP1
When used together with: Microsoft » Windows Xp » Update SP2
When used together with: Microsoft » Windows Xp » Update SP2 X64 Edition

Exploit prediction scoring system (EPSS) score for CVE-2008-3843

EPSS FAQ

27.79%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 97 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2008-3843

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
4.3	MEDIUM	AV:N/AC:M/Au:N/C:N/I:P/A:N	8.6	2.9	NIST
Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: None Integrity Impact: Partial Availability Impact: None

CWE ids for CVE-2008-3843

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2008-3843

Jump to

Vulnerability Details : CVE-2008-3843

Products affected by CVE-2008-3843

Exploit prediction scoring system (EPSS) score for CVE-2008-3843

CVSS scores for CVE-2008-3843

CWE ids for CVE-2008-3843

References for CVE-2008-3843