Vulnerability record · CVE-2004-0847 · published 3 November 2004
CVE-2004-0847: ASP.NET forms authentication bypass via backslash path traversal
Microsoft · Asp.Net
ASP.NET forms authentication can be bypassed for .aspx files in restricted directories by sending a request containing a backslash or its encoded form (%5C). The path validation flaw lets an unauthenticated remote attacker reach pages that should require a valid forms-auth cookie.
Description
The Microsoft .NET forms authentication capability for ASP.NET allows remote attackers to bypass authentication for .aspx files in restricted directories via a request containing a (1) "\" (backslash) or (2) "%5C" (encoded backslash), aka "Path Validation Vulnerability."
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Automated analysis
critical priorityCVSS 3.0 base score is 9.8 with no authentication or interaction required, and EPSS is very high with public exploit references.
What it is
ASP.NET forms authentication can be bypassed for .aspx files in restricted directories by sending a request containing a backslash or its encoded form (%5C). The path validation flaw lets an unauthenticated remote attacker reach pages that should require a valid forms-auth cookie.
Impact
An attacker gains access to protected .aspx pages and their functionality without valid credentials, potentially reading or acting on restricted application content.
Attack surface
Reachable over the network via HTTP requests to the affected ASP.NET application; no authentication or user interaction is required per the CVSS vector (AV:N/AC:L/PR:N/UI:N).
Exploitation
Not listed in CISA KEV, but EPSS is very high (0.757, ~99.5th percentile) and a reference is tagged Exploit, indicating public exploit material exists.
What to do
- Apply the Microsoft security update for MS05-004 (the vendor fix for this path validation issue).
- If patching is delayed, block requests containing backslashes or %5C in URL paths at the web server, proxy or WAF.
- Review IIS/ASP.NET URL normalization and request filtering settings to reject malformed path separators.
- Audit restricted directories to confirm no sensitive .aspx pages are exposed if the bypass is exercised.
Detection
- Search web server and proxy logs for requests to .aspx paths containing a backslash or %5C.
- Alert on access to restricted-directory .aspx resources from sessions lacking a valid forms-auth cookie.
- Correlate repeated 200 responses to protected paths with anomalous or unauthenticated client sessions.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2004-0847 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2004-0847), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
