CVE-2010-2084: XSS
Microsoft ASP.NET 2.0 does not prevent setting the InnerHtml property on a control that inherits from HtmlContainerControl, which allows remote attackers to conduct cross-site scripting (XSS) attacks via vectors related to an attribute.
Other sources
Microsoft ASP.NET is vulnerable to cross-site scripting. Setting the InnerHtml property on a control that inherits from HtmlContainerControl is not prevented. A remote attacker could exploit this vulnerability using vectors related to an attribute to steal the victim's cookie-based authentication credentials.
— IBM
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2010-2084?
CVE-2010-2084 is considered a medium severity vulnerability due to its potential for cross-site scripting attacks.
How do I fix CVE-2010-2084?
To fix CVE-2010-2084, validate and encode user inputs properly before using them in the InnerHtml property.
What software is affected by CVE-2010-2084?
CVE-2010-2084 affects Microsoft ASP.NET 2.0 and IBM Cognos Command Center versions up to 10.2.5.
Can CVE-2010-2084 lead to data breaches?
Yes, if exploited, CVE-2010-2084 can allow attackers to execute scripts in the context of a user’s session, potentially leading to data breaches.
Is there a patch available for CVE-2010-2084?
Patches and updates should be applied based on the specific software versions; check with Microsoft and IBM for the latest security updates.