Vulnerability Details CVE-2011-3415
Open redirect vulnerability in the Forms Authentication feature in the ASP.NET subsystem in Microsoft .NET Framework 2.0 SP2, 3.5 SP1, 3.5.1, and 4.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a crafted return URL, aka "Insecure Redirect in .NET Form Authentication Vulnerability."
Exploit prediction scoring system (EPSS) score
EPSS Score 0.489
EPSS Ranking 97.6%
CVSS Severity
CVSS v2 Score 6.8
References
- http://jvn.jp/en/jp/JVN71256611/index.html
- http://jvndb.jvn.jp/jvndb/JVNDB-2011-003557
- http://www.securityfocus.com/bid/51202
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-100
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14815
- http://jvn.jp/en/jp/JVN71256611/index.html
- http://jvndb.jvn.jp/jvndb/JVNDB-2011-003557
- http://www.securityfocus.com/bid/51202
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-100
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14815
Products affected by CVE-2011-3415
-
cpe:2.3:o:microsoft:windows_7:-
-
cpe:2.3:o:microsoft:windows_server_2003:-
-
cpe:2.3:o:microsoft:windows_server_2003:r2
-
cpe:2.3:o:microsoft:windows_server_2008:-
-
cpe:2.3:o:microsoft:windows_server_2008:r2
-
cpe:2.3:o:microsoft:windows_vista:-
-
cpe:2.3:o:microsoft:windows_xp:*
-
cpe:2.3:o:microsoft:windows_xp:sp3