{"api_version":"1","generated_at":"2026-04-22T23:31:23+00:00","cve":"CVE-2010-3332","urls":{"html":"https://cve.report/CVE-2010-3332","api":"https://cve.report/api/cve/CVE-2010-3332.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2010-3332","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2010-3332"},"summary":{"title":"CVE-2010-3332","description":"Microsoft .NET Framework 1.1 SP1, 2.0 SP1 and SP2, 3.5, 3.5 SP1, 3.5.1, and 4.0, as used for ASP.NET in Microsoft Internet Information Services (IIS), provides detailed error codes during decryption attempts, which allows remote attackers to decrypt and modify encrypted View State (aka __VIEWSTATE) form data, and possibly forge cookies or read application files, via a padding oracle attack, aka \"ASP.NET Padding Oracle Vulnerability.\"","state":"PUBLIC","assigner":"secure@microsoft.com","published_at":"2010-09-22 19:00:00","updated_at":"2020-11-23 19:50:00"},"problem_types":["CWE-209"],"metrics":[],"references":[{"url":"http://www.ekoparty.org/juliano-rizzo-2010.php","name":"http://www.ekoparty.org/juliano-rizzo-2010.php","refsource":"MISC","tags":["Broken Link"],"title":"ekoparty Security Conference","mime":"text/html","httpstatus":"404","archivestatus":"200"},{"url":"http://weblogs.asp.net/scottgu/archive/2010/09/18/important-asp-net-security-vulnerability.aspx","name":"http://weblogs.asp.net/scottgu/archive/2010/09/18/important-asp-net-security-vulnerability.aspx","refsource":"CONFIRM","tags":["Mitigation","Third Party Advisory"],"title":"Important: ASP.NET Security Vulnerability - ScottGu's Blog","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.dotnetnuke.com/Community/Blogs/tabid/825/EntryId/2799/Oracle-Padding-Vulnerability-in-ASP-NET.aspx","name":"http://www.dotnetnuke.com/Community/Blogs/tabid/825/EntryId/2799/Oracle-Padding-Vulnerability-in-ASP-NET.aspx","refsource":"MISC","tags":["Third Party Advisory"],"title":"DotNetNuke Blogs - Oracle Padding Vulnerability in ASP.NET","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://twitter.com/thaidn/statuses/24832350146","name":"http://twitter.com/thaidn/statuses/24832350146","refsource":"MISC","tags":["Broken Link"],"title":"JavaScript is not available.","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"http://www.vupen.com/english/advisories/2010/2751","name":"ADV-2010-2751","refsource":"VUPEN","tags":["Third Party Advisory"],"title":"Webmail : Solution de messagerie professionnelle - OVHcloud- OVH","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://blogs.technet.com/b/srd/archive/2010/09/17/understanding-the-asp-net-vulnerability.aspx","name":"http://blogs.technet.com/b/srd/archive/2010/09/17/understanding-the-asp-net-vulnerability.aspx","refsource":"CONFIRM","tags":["Vendor Advisory"],"title":"Understanding the ASP.NET Vulnerability - Security Research & Defense - Site Home - TechNet Blogs","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-070","name":"MS10-070","refsource":"MS","tags":["Patch","Vendor Advisory"],"title":"Microsoft Security Bulletin MS10-070 - Important | Microsoft Docs","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.vupen.com/english/advisories/2010/2429","name":"ADV-2010-2429","refsource":"VUPEN","tags":["Third Party Advisory"],"title":"Webmail : Solution de messagerie professionnelle - OVHcloud- OVH","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12365","name":"oval:org.mitre.oval:def:12365","refsource":"OVAL","tags":["Third Party Advisory"],"title":"Repository  /  Oval Repository","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.microsoft.com/technet/security/advisory/2416728.mspx","name":"http://www.microsoft.com/technet/security/advisory/2416728.mspx","refsource":"CONFIRM","tags":["Broken Link"],"title":"Your request has been blocked. This could be\r\n                        due to several reasons.","mime":"text/html","httpstatus":"403","archivestatus":"200"},{"url":"http://www.mono-project.com/Vulnerabilities#ASP.NET_Padding_Oracle","name":"http://www.mono-project.com/Vulnerabilities#ASP.NET_Padding_Oracle","refsource":"CONFIRM","tags":["Exploit","Third Party Advisory"],"title":"Vulnerabilities - Mono","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/43316","name":"43316","refsource":"BID","tags":["Third Party Advisory","VDB Entry"],"title":"Microsoft .NET Framework ASP.NET Padding Oracle Information Disclosure Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"http://pentonizer.com/general-programming/aspnet-poet-vulnerability-what-else-can-i-do/","name":"http://pentonizer.com/general-programming/aspnet-poet-vulnerability-what-else-can-i-do/","refsource":"MISC","tags":["Third Party Advisory"],"title":"ASP.NET POET Vulnerability - What Else Can I Do? : The Penton-izer","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.theinquirer.net/inquirer/news/1732956/security-researchers-destroy-microsoft-aspnet-security","name":"http://www.theinquirer.net/inquirer/news/1732956/security-researchers-destroy-microsoft-aspnet-security","refsource":"MISC","tags":["Third Party Advisory"],"title":"Security researchers 'destroy' microsoft asp.net security - The Inquirer","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://isc.sans.edu/diary.html?storyid=9568","name":"http://isc.sans.edu/diary.html?storyid=9568","refsource":"MISC","tags":["Third Party Advisory"],"title":"InfoSec Handlers Diary Blog","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.troyhunt.com/2010/09/fear-uncertainty-and-and-padding-oracle.html","name":"http://www.troyhunt.com/2010/09/fear-uncertainty-and-and-padding-oracle.html","refsource":"MISC","tags":["Exploit","Third Party Advisory"],"title":"Troy Hunt: Fear, uncertainty and the padding oracle exploit in ASP.NET","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://securitytracker.com/id?1024459","name":"1024459","refsource":"SECTRACK","tags":["Third Party Advisory","VDB Entry"],"title":"SecurityTracker.com Archives - Microsoft ASP.NET Padding Oracle Attack Lets Remote Users Decrypt Data","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/61898","name":"ms-aspdotnet-padding-info-disclosure(61898)","refsource":"XF","tags":["Third Party Advisory","VDB Entry"],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://threatpost.com/en_us/blogs/new-crypto-attack-affects-millions-aspnet-apps-091310","name":"http://threatpost.com/en_us/blogs/new-crypto-attack-affects-millions-aspnet-apps-091310","refsource":"MISC","tags":["Third Party Advisory"],"title":"'Padding Oracle' Crypto Attack Affects Millions of ASP.NET Apps | threatpost","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://secunia.com/advisories/41409","name":"41409","refsource":"SECUNIA","tags":["Third Party Advisory"],"title":"Microsoft ASP.NET Cryptographic Padding Oracle Information Disclosure - Advisories - Community","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2010-3332","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2010-3332","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2010","cve_id":"3332","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"microsoft","cpe5":".net_framework","cpe6":"1.1","cpe7":"sp1","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2010","cve_id":"3332","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"microsoft","cpe5":".net_framework","cpe6":"2.0","cpe7":"sp1","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2010","cve_id":"3332","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"microsoft","cpe5":".net_framework","cpe6":"2.0","cpe7":"sp2","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2010","cve_id":"3332","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"microsoft","cpe5":".net_framework","cpe6":"3.5","cpe7":"-","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2010","cve_id":"3332","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"microsoft","cpe5":".net_framework","cpe6":"3.5","cpe7":"sp1","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2010","cve_id":"3332","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"microsoft","cpe5":".net_framework","cpe6":"3.5.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2010","cve_id":"3332","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"microsoft","cpe5":".net_framework","cpe6":"4.0","cpe7":"-","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2010","cve_id":"3332","vulnerable":"1","versionEndIncluding":"1","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"microsoft","cpe5":".net_framework","cpe6":"1.1","cpe7":"sp1","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2010","cve_id":"3332","vulnerable":"1","versionEndIncluding":"1","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"microsoft","cpe5":".net_framework","cpe6":"2.0","cpe7":"sp1","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2010","cve_id":"3332","vulnerable":"1","versionEndIncluding":"1","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"microsoft","cpe5":".net_framework","cpe6":"2.0","cpe7":"sp2","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2010","cve_id":"3332","vulnerable":"1","versionEndIncluding":"1","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"microsoft","cpe5":".net_framework","cpe6":"3.5","cpe7":"-","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2010","cve_id":"3332","vulnerable":"1","versionEndIncluding":"1","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"microsoft","cpe5":".net_framework","cpe6":"3.5","cpe7":"sp1","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2010","cve_id":"3332","vulnerable":"1","versionEndIncluding":"1","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"microsoft","cpe5":".net_framework","cpe6":"3.5.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2010","cve_id":"3332","vulnerable":"1","versionEndIncluding":"1","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"microsoft","cpe5":".net_framework","cpe6":"4.0","cpe7":"-","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2010","cve_id":"3332","vulnerable":"-1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"microsoft","cpe5":"internet_information_services","cpe6":"-","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2010","cve_id":"3332","vulnerable":"0","versionEndIncluding":"1","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"microsoft","cpe5":"internet_information_services","cpe6":"-","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"CVE_data_meta":{"ASSIGNER":"secure@microsoft.com","ID":"CVE-2010-3332","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Microsoft .NET Framework 1.1 SP1, 2.0 SP1 and SP2, 3.5, 3.5 SP1, 3.5.1, and 4.0, as used for ASP.NET in Microsoft Internet Information Services (IIS), provides detailed error codes during decryption attempts, which allows remote attackers to decrypt and modify encrypted View State (aka __VIEWSTATE) form data, and possibly forge cookies or read application files, via a padding oracle attack, aka \"ASP.NET Padding Oracle Vulnerability.\""}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"http://www.ekoparty.org/juliano-rizzo-2010.php","refsource":"MISC","url":"http://www.ekoparty.org/juliano-rizzo-2010.php"},{"name":"oval:org.mitre.oval:def:12365","refsource":"OVAL","url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12365"},{"name":"ADV-2010-2751","refsource":"VUPEN","url":"http://www.vupen.com/english/advisories/2010/2751"},{"name":"http://www.dotnetnuke.com/Community/Blogs/tabid/825/EntryId/2799/Oracle-Padding-Vulnerability-in-ASP-NET.aspx","refsource":"MISC","url":"http://www.dotnetnuke.com/Community/Blogs/tabid/825/EntryId/2799/Oracle-Padding-Vulnerability-in-ASP-NET.aspx"},{"name":"http://weblogs.asp.net/scottgu/archive/2010/09/18/important-asp-net-security-vulnerability.aspx","refsource":"CONFIRM","url":"http://weblogs.asp.net/scottgu/archive/2010/09/18/important-asp-net-security-vulnerability.aspx"},{"name":"http://www.troyhunt.com/2010/09/fear-uncertainty-and-and-padding-oracle.html","refsource":"MISC","url":"http://www.troyhunt.com/2010/09/fear-uncertainty-and-and-padding-oracle.html"},{"name":"41409","refsource":"SECUNIA","url":"http://secunia.com/advisories/41409"},{"name":"43316","refsource":"BID","url":"http://www.securityfocus.com/bid/43316"},{"name":"http://www.mono-project.com/Vulnerabilities#ASP.NET_Padding_Oracle","refsource":"CONFIRM","url":"http://www.mono-project.com/Vulnerabilities#ASP.NET_Padding_Oracle"},{"name":"http://www.microsoft.com/technet/security/advisory/2416728.mspx","refsource":"CONFIRM","url":"http://www.microsoft.com/technet/security/advisory/2416728.mspx"},{"name":"1024459","refsource":"SECTRACK","url":"http://securitytracker.com/id?1024459"},{"name":"http://blogs.technet.com/b/srd/archive/2010/09/17/understanding-the-asp-net-vulnerability.aspx","refsource":"CONFIRM","url":"http://blogs.technet.com/b/srd/archive/2010/09/17/understanding-the-asp-net-vulnerability.aspx"},{"name":"http://isc.sans.edu/diary.html?storyid=9568","refsource":"MISC","url":"http://isc.sans.edu/diary.html?storyid=9568"},{"name":"ADV-2010-2429","refsource":"VUPEN","url":"http://www.vupen.com/english/advisories/2010/2429"},{"name":"MS10-070","refsource":"MS","url":"https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-070"},{"name":"http://www.theinquirer.net/inquirer/news/1732956/security-researchers-destroy-microsoft-aspnet-security","refsource":"MISC","url":"http://www.theinquirer.net/inquirer/news/1732956/security-researchers-destroy-microsoft-aspnet-security"},{"name":"http://threatpost.com/en_us/blogs/new-crypto-attack-affects-millions-aspnet-apps-091310","refsource":"MISC","url":"http://threatpost.com/en_us/blogs/new-crypto-attack-affects-millions-aspnet-apps-091310"},{"name":"http://twitter.com/thaidn/statuses/24832350146","refsource":"MISC","url":"http://twitter.com/thaidn/statuses/24832350146"},{"name":"http://pentonizer.com/general-programming/aspnet-poet-vulnerability-what-else-can-i-do/","refsource":"MISC","url":"http://pentonizer.com/general-programming/aspnet-poet-vulnerability-what-else-can-i-do/"},{"name":"ms-aspdotnet-padding-info-disclosure(61898)","refsource":"XF","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/61898"}]}},"nvd":{"publishedDate":"2010-09-22 19:00:00","lastModifiedDate":"2020-11-23 19:50:00","problem_types":["CWE-209"],"metrics":{"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:N","accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"NONE","baseScore":6.4},"severity":"MEDIUM","exploitabilityScore":10,"impactScore":4.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"AND","children":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:microsoft:.net_framework:1.1:sp1:*:*:*:*:*:*","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:microsoft:.net_framework:2.0:sp2:*:*:*:*:*:*","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:microsoft:.net_framework:2.0:sp1:*:*:*:*:*:*","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:microsoft:.net_framework:3.5:sp1:*:*:*:*:*:*","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:microsoft:.net_framework:3.5:-:*:*:*:*:*:*","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:microsoft:.net_framework:3.5.1:*:*:*:*:*:*:*","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:microsoft:.net_framework:4.0:-:*:*:*:*:*:*","cpe_name":[]}]},{"operator":"OR","children":[],"cpe_match":[{"vulnerable":false,"cpe23Uri":"cpe:2.3:a:microsoft:internet_information_services:-:*:*:*:*:*:*:*","cpe_name":[]}]}],"cpe_match":[]}]}},"legacy_mitre":{"record":{"CveYear":"2010","CveId":"3332","Ordinal":"45607","Title":"CVE-2010-3332","CVE":"CVE-2010-3332","Year":"2010"},"notes":[{"CveYear":"2010","CveId":"3332","Ordinal":"1","NoteData":"Microsoft .NET Framework 1.1 SP1, 2.0 SP1 and SP2, 3.5, 3.5 SP1, 3.5.1, and 4.0, as used for ASP.NET in Microsoft Internet Information Services (IIS), provides detailed error codes during decryption attempts, which allows remote attackers to decrypt and modify encrypted View State (aka __VIEWSTATE) form data, and possibly forge cookies or read application files, via a padding oracle attack, aka \"ASP.NET Padding Oracle Vulnerability.\"","Type":"Description","Title":null},{"CveYear":"2010","CveId":"3332","Ordinal":"2","NoteData":"2010-09-22","Type":"Other","Title":"Published"},{"CveYear":"2010","CveId":"3332","Ordinal":"3","NoteData":"2018-10-12","Type":"Other","Title":"Modified"}]}}}