CVE-2011-2012
Last modified
CVE-2011-2012 is a vulnerability of currently unknown severity. Microsoft Forefront Unified Access Gateway (UAG) 2010 Gold, Update 1, Update 2, and SP1 does not properly validate session cookies, which allows remote attackers to cause a denial of service (IIS outage) via unspecified network traffic, aka "Null Session Cookie Crash.". EPSS estimates a 16.59% chance of exploitation in the next 30 days.
Description
Microsoft Forefront Unified Access Gateway (UAG) 2010 Gold, Update 1, Update 2, and SP1 does not properly validate session cookies, which allows remote attackers to cause a denial of service (IIS outage) via unspecified network traffic, aka "Null Session Cookie Crash."
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Microsoft | Forefront Unified Access Gateway | 2010 |
References
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2011-2012?
How severe is CVE-2011-2012?
How do I fix CVE-2011-2012?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2011
- CVE-2011-2006Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
- CVE-2011-2007Microsoft Host Integration Server (HIS) 2004 SP1, 2006 SP1, …
- CVE-2011-2008Microsoft Host Integration Server (HIS) 2004 SP1, 2006 SP1, …
- CVE-2011-2009Untrusted search path vulnerability in Windows Media Center …
- CVE-2011-2010The Microsoft Office Input Method Editor (IME) for Simplifie…
- CVE-2011-2011Use-after-free vulnerability in win32k.sys in the kernel-mod…
- CVE-2011-2013Integer overflow in the TCP/IP implementation in Microsoft W…9.8
- CVE-2011-2014The LDAP over SSL (aka LDAPS) implementation in Active Direc…
- CVE-2011-2015Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
- CVE-2011-2016Untrusted search path vulnerability in Windows Mail and Wind…7.3
- CVE-2011-2017Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
- CVE-2011-2018The kernel in Microsoft Windows XP SP2 and SP3, Windows Serv…
Are you affected by CVE-2011-2012?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST