CVE-2004-0847
CriticalSummary
The Microsoft .NET forms authentication capability for ASP.NET allows remote attackers to bypass authentication for .aspx files in restricted directories via a request containing a backslash (\) or encoded backslash (%5C).
Risk Assessment
An attacker can gain unauthorized access to protected ASP.NET resources, potentially leading to disclosure of sensitive data or system integrity compromise.
Recommendation
Apply the appropriate security patches provided by Microsoft and configure the web server to reject requests containing backslash characters in URL paths.
Original NVD description (English source)
The Microsoft .NET forms authentication capability for ASP.NET allows remote attackers to bypass authentication for .aspx files in restricted directories via a request containing a (1) "\" (backslash) or (2) "%5C" (encoded backslash), aka "Path Validation Vulnerability."