CVE-2010-3332
Microsoft .NET Framework 1.1 SP1, 2.0 SP1 and SP2, 3.5, 3.5 SP1, 3.5.1, and 4.0, as used for ASP...
Microsoft .NET Framework 1.1 SP1, 2.0 SP1 and SP2, 3.5, 3.5 SP1, 3.5.1, and 4.0, as used for ASP.NET in Microsoft Internet Information Services (IIS), provides detailed error codes during decryption attempts, which allows remote attackers to decrypt and modify encrypted View State (aka __VIEWSTATE) form data, and possibly forge cookies or read application files, via a padding oracle attack, aka "ASP.NET Padding Oracle Vulnerability."
Exploit likelihood
What each source reports
NVD Score used
Microsoft .NET Framework 1.1 SP1, 2.0 SP1 and SP2, 3.5, 3.5 SP1, 3.5.1, and 4.0, as used for ASP.NET in Microsoft Internet Information Services (IIS), provides detailed error codes during decryption attempts, which allows remote attackers to decrypt and modify encrypted View State (aka __VIEWSTATE) form data, and possibly forge cookies or read application files, via a padding oracle attack, aka "ASP.NET Padding Oracle Vulnerability."
- Record
CVE-2010-3332- CVSS 2.0
- 6.4 Medium
AV:N/AC:L/Au:N/C:P/I:P/A:N - Weakness
- CWE-209
- Updated
- 2026-11-02
CVE List No score
Microsoft .NET Framework 1.1 SP1, 2.0 SP1 and SP2, 3.5, 3.5 SP1, 3.5.1, and 4.0, as used for ASP.NET in Microsoft Internet Information Services (IIS), provides detailed error codes during decryption attempts, which allows remote attackers to decrypt and modify encrypted View State (aka __VIEWSTATE) form data, and possibly forge cookies or read application files, via a padding oracle attack, aka "ASP.NET Padding Oracle Vulnerability."
- Record
CVE-2010-3332- Updated
- 2026-11-02
EUVDEUVD-2010-3330 No score
Microsoft .NET Framework 1.1 SP1, 2.0 SP1 and SP2, 3.5, 3.5 SP1, 3.5.1, and 4.0, as used for ASP.NET in Microsoft Internet Information Services (IIS), provides detailed error codes during decryption attempts, which allows remote attackers to decrypt and modify encrypted View State (aka __VIEWSTATE) form data, and possibly forge cookies or read application files, via a padding oracle attack, aka "ASP.NET Padding Oracle Vulnerability."
- Record
EUVD-2010-3330- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-crcj-w6h9-q5f6 No score
Microsoft .NET Framework 1.1 SP1, 2.0 SP1 and SP2, 3.5, 3.5 SP1, 3.5.1, and 4.0, as used for ASP...
Microsoft .NET Framework 1.1 SP1, 2.0 SP1 and SP2, 3.5, 3.5 SP1, 3.5.1, and 4.0, as used for ASP.NET in Microsoft Internet Information Services (IIS), provides detailed error codes during decryption attempts, which allows remote attackers to decrypt and modify encrypted View State (aka __VIEWSTATE) form data, and possibly forge cookies or read application files, via a padding oracle attack, aka "ASP.NET Padding Oracle Vulnerability."
- Record
GHSA-crcj-w6h9-q5f6- Weakness
- CWE-209
- Updated
- 2026-11-02
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Microsoft ASP.NET - Padding Oracle (MS10-070) | 2010-10-06 |
| Exploit-DB | Microsoft ASP.NET - Padding Oracle File Download (MS10-070) | 2010-10-17 |
| Exploit-DB | Microsoft ASP.NET - Auto-Decryptor File Download (MS10-070) | 2010-10-20 |
| PoC in GitHub | bongbongco/MS10-070 | 2017-10-11 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2010-3332 is a medium vulnerability (CVSS 6.4) in Microsoft .net Framework, published September 22, 2010. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 68.2%, the 99th percentile. No source names a fixed version.
References
ekoparty.org/juliano-rizzo-2010.php
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12365
vupen.com/english/advisories/2010/2751
dotnetnuke.com/Community/Blogs/tabid/825/EntryId/2799/Oracle-Padding-Vulnerability-in-ASP-NET.aspx
weblogs.asp.net/scottgu/archive/2010/09/18/important-asp-net-security-vulnerability.aspx
troyhunt.com/2010/09/fear-uncertainty-and-and-padding-oracle.html
Show 16 moreShow less
secunia.com/advisories/41409
securityfocus.com/bid/43316
mono-project.com/Vulnerabilities
microsoft.com/technet/security/advisory/2416728.mspx
securitytracker.com/id?1024459
blogs.technet.com/b/srd/archive/2010/09/17/understanding-the-asp-net-vulnerability.aspx
isc.sans.edu/diary.html?storyid=9568
docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-070
theinquirer.net/inquirer/news/1732956/security-researchers-destroy-microsoft-aspnet-security
threatpost.com/en_us/blogs/new-crypto-attack-affects-millions-aspnet-apps-091310
twitter.com/thaidn/statuses/24832350146
pentonizer.com/general-programming/aspnet-poet-vulnerability-what-else-can-i-do
exchange.xforce.ibmcloud.com/vulnerabilities/61898
nvd.nist.gov/vuln/detail/CVE-2010-3332
github.com/advisories/GHSA-crcj-w6h9-q5f6