CVE-2015-6099: Microsoft .NET Framework ASP.NET XSS elevation of privilege

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

medium priorityCVSS v2 rates it medium (4.3) with partial integrity impact only, but the high EPSS percentile and broad .NET Framework exposure justify prompt patching.

What it is

ASP.NET in Microsoft .NET Framework 4 through 4.6 fails to properly neutralize a crafted value, allowing cross-site scripting. An attacker can inject arbitrary script or HTML into a page rendered by an affected ASP.NET application, which matters because it can be used to run script in a victim's browser session. The record does not identify the specific ASP.NET component or the exact crafted input.

Impact

An attacker can execute arbitrary script or HTML in the context of a victim's browser session, enabling content injection, session theft or actions performed as the victim. The CVSS v2 vector rates only partial integrity impact with no confidentiality or availability impact.

Attack surface

Reachable over the network (AV:N) with no authentication required (Au:N), but exploitation requires some user interaction or a non-trivial condition (AC:M), consistent with a reflected or crafted-value XSS. The description does not state which ASP.NET endpoint or parameter is involved.

Exploitation

Not listed in CISA KEV and no ransomware association is recorded. EPSS is 0.47584 (98.8th percentile), indicating a high modeled likelihood of exploitation activity, but the references carry no exploit tags and no public exploit is confirmed by this record.

What to do

• Apply the Microsoft security update for MS15-118 (.NET Framework) on all affected systems.
• Upgrade .NET Framework 4, 4.5, 4.5.1, 4.5.2 and 4.6 to a supported, patched release.
• Enforce output encoding and input validation on ASP.NET pages that render user-supplied values.
• Deploy a WAF or response header controls (CSP, X-Content-Type-Options) as compensating controls where patching is delayed.
• Inventory internet-facing ASP.NET applications running the affected framework versions.

Detection

• Review web server and WAF logs for requests containing script or HTML markup in parameters and headers.
• Monitor for reflected script payloads in application responses and for anomalous client-side execution reports.
• Hunt for known XSS probe patterns and repeated crafted-value requests against ASP.NET endpoints.
• Correlate application error logs around ASP.NET request validation failures.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.