Information disclosure in Microsoft Chart Control For .Net Framework

CVE-2011-1977

The ASP.NET Chart controls in Microsoft .NET Framework 4, and Chart Control for Microsoft .NET Framework 3.5 SP1, do not properly verify functions in URIs, which allows remote attackers to read arbitrary files via special characters in a URI in an HTTP request, aka "Chart Control Information Disclosure Vulnerability."

Vulnerability class: Information Disclosure

Published 2011-08-10 · last modified 2026-06-16.

CVSS v2 metric

CVSS v2 base score 4.3 (Medium). Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N. This CVE predates CVSS v3 and has no v3 score from NVD.

EPSS exploit prediction

EPSS: 0.214 (97.5th percentile), scored 2026-10-02.

Moderate probability of exploitation in the next 30 days — watch for active exploitation reports. 98th percentile — 97.5% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.214 · newest: 0.214 · change: 0.000

Affected products

Microsoft Chart Control For .Net Framework — versions 3.5
Microsoft .Net Framework — versions 4.0
Microsoft Windows 2003 Server
Microsoft Windows 7
Microsoft Windows Server 2003
Microsoft Windows Server 2008 — versions r2
Microsoft Windows Vista
Microsoft Windows Xp

Weakness classification (CWE)

CWE-200 — Information Disclosure

References

oval.cisecurity.org/repository/search/definition/oval:org.mitre.oval:def:12970 (signature, vdb-entry)
docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-066 (vendor-advisory)
www.us-cert.gov/cas/techalerts/TA11-221A.html (US Government Resource, third-party-advisory)