CVE-2010-2085

Published: May 27, 2010Modified: Apr 29, 2026

4.3

Vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability: 8.6 / Impact: 2.9

Source: NVD

Description

The default configuration of ASP.NET in Microsoft .NET before 1.1 has a value of FALSE for the EnableViewStateMac property, which allows remote attackers to conduct cross-site scripting (XSS) attacks via the __VIEWSTATE parameter.

Affected (6)

Products: Microsoft: .net Framework

Microsoft

1 product

.net Framework

Configuration A

6 vulnerable

Vulnerable Software	Affected Versions
Microsoft .net Framework	Up to 1.0
Microsoft .net Framework	Version 1.0
Microsoft .net Framework	Version 1.0 beta2
Microsoft .net Framework	Version 1.0 gold
Microsoft .net Framework	Version 1.0 sp1
Microsoft .net Framework	Version 1.0 sp2