Description
Improper encoding or escaping of output in .NET allows an authorized attacker to perform spoofing over a network.
CVSS breakdown
CVSS 3.1
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
None
E
Unchanged
RL
O
RC
Changed
Affected products
- microsoft / Microsoft .NET Framework 3.53.5.0 – 2.0.50727.8983 & 3.0.30729.8978
- microsoft / Microsoft .NET Framework 3.5 AND 4.7.24.7.0 – 2.0.50727.9069 & 3.0.30729.9067 & 4.7.4143.0
- microsoft / Microsoft .NET Framework 3.5 AND 4.84.8.0 – 2.0.50727.9069 & 3.0.30729.9067 & 4.8.4803.0
- microsoft / Microsoft .NET Framework 3.5 AND 4.8.14.8.1 – 2.0.50727.9182 & 3.0.30729.9168 & 4.8.9339.0
- microsoft / Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.24.7.0 – 4.7.4143.0
- microsoft / Microsoft .NET Framework 4.84.8.0 – 4.8.4803.0
- microsoft / Microsoft .NET Framework 4.8.14.8.0.0 – 4.8.9340.0
- microsoft / Microsoft Visual Studio 2022 version 17.1217.12.0 – 17.12.22
- microsoft / Microsoft Visual Studio 2022 version 17.1417.14.0 – 17.14.36
- microsoft / Microsoft Visual Studio 2026 version 18.718.0 – 18.7.4
- microsoft / .net8.0.0 – 8.0.29
- microsoft / .NET 10.010.0.0 – 10.0.6
- microsoft / .NET 10.010.0.0 – 10.0.10
- microsoft / .NET 8.08.0.0 – 8.0.29
- microsoft / .NET 9.09.0.0 – 9.0.18
- microsoft / .net_framework4.8 – 4.8
- microsoft / .net_framework4.6.2 – 4.6.2
- microsoft / .net_framework4.7 – 4.7
- microsoft / .net_framework4.7.2 – 4.7.2
- microsoft / .net_framework3.5 – 3.5
- microsoft / .net_framework4.7.1 – 4.7.1
- microsoft / .net_framework4.8.1 – 4.8.1
- microsoft / visual_studio_202217.12.0 – 17.12.22
- microsoft / visual_studio_202618.7.0 – 18.7.4
References
Updated 12m ago · 8 sources