(MS14-059) Vulnerability in ASP.NET MVC Could Allow Security Feature Bypass (2990942)

• Email
• Facebook
• 
  Twitter
• Google+
• Linkedin

  Severity: HIGH

  CVE Identifier: CVE-2014-4075

  Advisory Date: NOV 11, 2014

---

  DESCRIPTION

This update resolves a cross-site scripting vulnerability found in ASP.NET MVC. The vulnerability allows to bypass the built-in security feature in the said software.

  SOLUTION

  PATCH: https://technet.microsoft.com/library/security/ms14-059

  AFFECTED SOFTWARE AND VERSION

• ASP.NET MVC 2.0
• ASP.NET MVC 3.0
• ASP.NET MVC 4.0
• ASP.NET MVC 5.0
• ASP.NET MVC 5.1

Related Vulnerability

• October 2014 - Microsoft Releases 8 Security Advisories