Microsoft is currently investigating a reported vulnerability in Microsoft ASP.NET. An attacker can send specially crafted requests to the server and view secured content without providing the proper credentials. This reported vulnerability exists in ASP.NET and does not affect ASP.
You can download this advisory from the following link: https://packetstormsecurity.com/files/download/34618/cannonicalization.txt
Source: https://packetstormsecurity.com/files/34618/cannonicalization.txt.html