CVE-2010-2088: ASP.NET in Microsoft .NET 3.5 does not properly handle an unencrypted view state, which allows remote attac...

Security readout for executives and security teams

This CVE describes an ASP.NET .NET 3.5 issue where unencrypted ViewState can be mishandled, enabling cross-site scripting through the __VIEWSTATE parameter. Business risk depends on whether public-facing ASP.NET forms still use affected .NET 3.5 behavior. Most likely exposure is legacy ASP.NET applications running Microsoft .NET 3.5 with forms that use ViewState. The provided affected-product data is incomplete and lists no precise CPEs or versions beyond the CVE description. Treat this as a legacy exposure review item, not a confirmed emergency from the provided evidence. Give priority to public-facing .NET 3.5 applications because XSS can affect users, sessions, and trust in web services. Mitigation focus: Inventory ASP.NET applications that still depend on Microsoft .NET 3.5.; Check Microsoft and application-vendor guidance for supported fixes or configuration changes.; Prioritize remediation for internet-facing forms that accept ViewState-bearing requests..

Prepared

Jun 28, 2026, 02:49 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.