CVE-2015-6099

2015-11-1112:59:38

CWE-79

[email protected]

web.nvd.nist.gov

198

asp.net

xss

vulnerability

microsoft

.net framework

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

4.5 Medium

AI Score

Confidence

High

0.213 Low

EPSS

Percentile

96.4%

JSON

Cross-site scripting (XSS) vulnerability in ASP.NET in Microsoft .NET Framework 4, 4.5, 4.5.1, 4.5.2, and 4.6 allows remote attackers to inject arbitrary web script or HTML via a crafted value, aka “.NET Elevation of Privilege Vulnerability.”

Affected configurations

NVD

Node

microsoft.net_frameworkMatch4.0

microsoft.net_frameworkMatch4.5

microsoft.net_frameworkMatch4.5.1

microsoft.net_frameworkMatch4.5.2

microsoft.net_frameworkMatch4.6

CPENameOperatorVersion
microsoft:.net_frameworkmicrosoft .net frameworkeq4.0
microsoft:.net_frameworkmicrosoft .net frameworkeq4.5
microsoft:.net_frameworkmicrosoft .net frameworkeq4.5.1
microsoft:.net_frameworkmicrosoft .net frameworkeq4.5.2
microsoft:.net_frameworkmicrosoft .net frameworkeq4.6

CPE	Name	Operator	Version
microsoft:.net_framework	microsoft .net framework	eq	4.0
microsoft:.net_framework	microsoft .net framework	eq	4.5
microsoft:.net_framework	microsoft .net framework	eq	4.5.1
microsoft:.net_framework	microsoft .net framework	eq	4.5.2
microsoft:.net_framework	microsoft .net framework	eq	4.6