CVE-2004-0847: Microsoft ASP.NET

Critical severity, CVSS 9.8. EPSS: 75.7% chance of exploitation in the next 30 days.

The Microsoft .NET forms authentication capability for ASP.NET allows remote attackers to bypass authentication for .aspx files in restricted directories via a request containing a (1) "\" (backslash) or (2) "%5C" (encoded backslash), aka "Path Validation Vulnerability."

Affected products

• Microsoft ASP.NET: up to and including 1.1; version 1.1 only

Published 2004-11-03. Last modified 2026-06-16.