CVE-2010-3332

Public Exploit

Description

Microsoft .NET Framework 1.1 SP1, 2.0 SP1 and SP2, 3.5, 3.5 SP1, 3.5.1, and 4.0, as used for ASP.NET in Microsoft Internet Information Services (IIS), provides detailed error codes during decryption attempts, which allows remote attackers to decrypt and modify encrypted View State (aka __VIEWSTATE) form data, and possibly forge cookies or read application files, via a padding oracle attack, aka "ASP.NET Padding Oracle Vulnerability."

Category

6.4
CVSS
Severity: Medium
CVSS 2.0 •
EPSS 89.68% Top 5%
Vendor Advisory microsoft.com Vendor Advisory technet.com
Affected: n/a n/a
Published at:
Updated at:

References

Link Tags
http://www.ekoparty.org/juliano-rizzo-2010.php broken link
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12365 vdb entry third party advisory signature
http://www.vupen.com/english/advisories/2010/2751 vdb entry third party advisory
http://www.dotnetnuke.com/Community/Blogs/tabid/825/EntryId/2799/Oracle-Padding-Vulnerability-in-ASP-NET.aspx third party advisory
http://weblogs.asp.net/scottgu/archive/2010/09/18/important-asp-net-security-vulnerability.aspx third party advisory mitigation
http://www.troyhunt.com/2010/09/fear-uncertainty-and-and-padding-oracle.html third party advisory exploit
http://secunia.com/advisories/41409 third party advisory
http://www.securityfocus.com/bid/43316 vdb entry third party advisory
http://www.mono-project.com/Vulnerabilities#ASP.NET_Padding_Oracle third party advisory exploit
http://www.microsoft.com/technet/security/advisory/2416728.mspx broken link
http://securitytracker.com/id?1024459 vdb entry third party advisory
http://blogs.technet.com/b/srd/archive/2010/09/17/understanding-the-asp-net-vulnerability.aspx vendor advisory
http://isc.sans.edu/diary.html?storyid=9568 third party advisory
http://www.vupen.com/english/advisories/2010/2429 vdb entry third party advisory
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-070 patch vendor advisory
http://www.theinquirer.net/inquirer/news/1732956/security-researchers-destroy-microsoft-aspnet-security third party advisory
http://threatpost.com/en_us/blogs/new-crypto-attack-affects-millions-aspnet-apps-091310 third party advisory
http://twitter.com/thaidn/statuses/24832350146 broken link
http://pentonizer.com/general-programming/aspnet-poet-vulnerability-what-else-can-i-do/ third party advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/61898 vdb entry third party advisory

Frequently Asked Questions

What is the severity of CVE-2010-3332?
CVE-2010-3332 has been scored as a medium severity vulnerability.
How to fix CVE-2010-3332?
To fix CVE-2010-3332, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2010-3332 being actively exploited in the wild?
It is possible that CVE-2010-3332 is being exploited or will be exploited in a near future based on public information. According to its EPSS score, there is a ~90% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.
© 2025 Under My Watch. All Rights Reserved.