CVE-2004-0847

Description

The Microsoft .NET forms authentication capability for ASP.NET allows remote attackers to bypass authentication for .aspx files in restricted directories via a request containing a (1) "\" (backslash) or (2) "%5C" (encoded backslash), aka "Path Validation Vulnerability."

Weakness classification

• CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Primary references

• cve@mitre.org — Exploit, Vendor Advisory
• cve@mitre.org — Broken Link
• cve@mitre.org — Third Party Advisory, US Government Resource
• cve@mitre.org — Third Party Advisory, VDB Entry
• cve@mitre.org — Third Party Advisory, US Government Resource
• cve@mitre.org
• cve@mitre.org — Third Party Advisory, VDB Entry
• cve@mitre.org — Third Party Advisory
• cve@mitre.org — Third Party Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Exploit, Vendor Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Broken Link
• af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory, US Government Resource