Read the docs
TI-2005-01573 Aliases CVE-2005-1664GHSA-jw4m-hjv5-r4mr

The __VIEWSTATE functionality in Microsoft ASP.NET 1.x allows remote attackers to conduct…

Priority MEDIUM 46Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Partial · Partial · None
Fix status
No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA.

Summary

The __VIEWSTATE functionality in Microsoft ASP.NET 1.x allows remote attackers to conduct replay attacks to (1) apply a ViewState generated from one view to a different view, (2) reuse ViewState information after the application's state has changed, or (3) use the ViewState to conduct attacks or expose content to third parties.

Why it matters now

EPSS 0.18847 97th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:microsoft:asp.net:1.0:*:*:*:*:*:*:*1.0VulnerableMicrosoft
cpe:2.3:a:microsoft:asp.net:1.1:*:*:*:*:*:*:*1.1VulnerableMicrosoft
  • cpe:2.3:a:microsoft:asp.net:1.0:*:*:*:*:*:*:* Versions 1.0 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:asp.net:1.1:*:*:*:*:*:*:* Versions 1.1 Vulnerable ·Microsoft

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2005-1664
  2. 2026-10-03 Alias added: GHSA-jw4m-hjv5-r4mr

References

Other 4

  • TI-2004-00784 The Microsoft .NET forms authentication capability for ASP.NET allows remote attackers to… CVSS 3.0CRITICAL 9.8
  • TI-2006-01318 Microsoft w3wp (aka w3wp.exe) does not properly handle when the AspCompat directive is… CVSS 3.0HIGH 7.5
  • TI-2005-01574 The __VIEWSTATE functionality in Microsoft ASP.NET 1.x, when not cryptographically… CVSS 2.0MEDIUM 5.0
  • TI-2003-00711 Microsoft ASP.Net 1.1 allows remote attackers to bypass the Cross-Site Scripting (XSS)… CVSS 2.0MEDIUM 6.8
  • TI-2005-02103 aspnet_wp.exe in Microsoft ASP.NET web services allows remote attackers to cause a denial… CVSS 2.0MEDIUM 5.0
  • TI-2005-00410 Multiple cross-site scripting (XSS) vulnerabilities in Microsoft ASP.NET (.Net) 1.0 and… CVSS 2.0MEDIUM 4.3
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences