CVE-2010-3332

Severity: medium (CVSS 6.4 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 68.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2010-09-22 · updated 2026-06-16
Weakness: CWE-209

Description

Microsoft .NET Framework 1.1 SP1, 2.0 SP1 and SP2, 3.5, 3.5 SP1, 3.5.1, and 4.0, as used for ASP.NET in Microsoft Internet Information Services (IIS), provides detailed error codes during decryption attempts, which allows remote attackers to decrypt and modify encrypted View State (aka __VIEWSTATE) form data, and possibly forge cookies or read application files, via a padding oracle attack, aka "ASP.NET Padding Oracle Vulnerability."

Affected products

Microsoft .NET Framework: 1.1-sp1, 2.0-sp1, 2.0-sp2, 3.5, 3.5-sp1, 3.5.1 (+1)

References

http://blogs.technet.com/b/srd/archive/2010/09/17/understanding-the-asp-net-vulnerability.aspx
http://isc.sans.edu/diary.html?storyid=9568
http://pentonizer.com/general-programming/aspnet-poet-vulnerability-what-else-can-i-do/
http://secunia.com/advisories/41409
http://securitytracker.com/id?1024459
http://threatpost.com/en_us/blogs/new-crypto-attack-affects-millions-aspnet-apps-091310
http://twitter.com/thaidn/statuses/24832350146
http://weblogs.asp.net/scottgu/archive/2010/09/18/important-asp-net-security-vulnerability.aspx
http://www.dotnetnuke.com/Community/Blogs/tabid/825/EntryId/2799/Oracle-Padding-Vulnerability-in-ASP-NET.aspx
http://www.ekoparty.org/juliano-rizzo-2010.php
http://www.microsoft.com/technet/security/advisory/2416728.mspx
http://www.mono-project.com/Vulnerabilities#ASP.NET_Padding_Oracle

Get alerted when CVE-2010-3332 or the next vulnerability affects your stack