peter bassill · operator
$ cve CVE-2006-1364 JSON

CVE-2006-1364 EXPLOIT

7.5
HIGH · CVSS 3.0 · EPSS 58.7% (pctl 99)

Patch early

A public exploit exists.

Description

Microsoft w3wp (aka w3wp.exe) does not properly handle when the AspCompat directive is not used when referencing COM components in ASP.NET, which allows remote attackers to cause a denial of service (resource consumption or crash) by repeatedly requesting each of several documents that refer to COM components, or are restricted documents located under the ASP.NET application path.

Scoring

CVSS7.5 (HIGH, v3.0)
VectorCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS58.74% — more likely to be exploited than 99% of all CVEs
WeaknessCWE-400
On CISA KEVno
Public exploityes
Published2006-03-23
Last modified2026-06-16

Affected (1)

VendorProduct
microsoftasp.net

Public exploits

SourceTitleDate
exploit-dbASP.NET w3wp - COM Components Remote Crash2006-03-22

References

→ the Explorer  ·  watch your stack  ·  NVD