Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2004-0847

CWE-22 — Path Traversal5 documents5 sources
Severity
9.8CRITICAL
EPSS
52.8%
top 2.05%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
1
Microsoft Asp.net
Timeline
PublishedNov 3
Latest updateApr 29

Description

The Microsoft .NET forms authentication capability for ASP.NET allows remote attackers to bypass authentication for .aspx files in restricted directories via a request containing a (1) "\" (backslash) or (2) "%5C" (encoded backslash), aka "Path Validation Vulnerability."

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages1 packages

🔴Vulnerability Details

3
GHSA
GHSA-wxfc-g96x-mm56: The Microsoft↗2022-04-29
▶
CVEList
CVE-2004-0847: The Microsoft↗2004-10-06
▶
VulnCheck
Microsoft asp.net Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')↗2004
▶

💥Exploits & PoCs

1
Exploit-DB
Microsoft ASP.NET 1.x - URI Canonicalization Unauthorized Web Access↗2004-10-06
▶