CVE-2024-29059highunder attackCWE-209

CVE-2024-29059: high-severity vulnerability in Microsoft .NET Framework 2.0 Service Pack 2

.NET Framework Information Disclosure Vulnerability

Published · Updated

Follow this CVE+ Monitor Microsoft .NET Framework+ Monitor Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 7.5epss 99%
from disclosure to weaponsame day
Published on NVDMar 22
1st PoCMar 11
CISA KEV+319d
What the vendors declare (VEX)

Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.

Red HatVEX document ↗
Not affected
4 products (97 components) — because the vulnerable code is not present in the product
Red Hat Enterprise Linux 8 · Red Hat Enterprise Linux 9 · .NET 6.0 on Red Hat Enterprise Linux · Red Hat Enterprise Linux 10
Action required by CISAfederal deadline: 2025-02-25

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

In short

The .NET Framework can inadvertently expose sensitive system information through error messages or responses. This leakage helps attackers understand the application's internals and plan targeted attacks.

Technical detail

An information disclosure vulnerability in .NET Framework allows remote attackers to obtain sensitive details about the system, application configuration, or internal paths through improper error handling or response mechanisms. The vulnerability has a CVSS score of 7.5, indicating high severity without requiring authentication or user interaction.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

.NET Framework Information Disclosure Vulnerability
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
Affected products
Microsoft · Microsoft .NET Framework 2.0 Service Pack 2Microsoft · Microsoft .NET Framework 3.0 Service Pack 2Microsoft · Microsoft .NET Framework 3.5Microsoft · Microsoft .NET Framework 3.5.1Microsoft · Microsoft .NET Framework 3.5 AND 4.6/4.6.2Microsoft · Microsoft .NET Framework 3.5 AND 4.7.2Microsoft · Microsoft .NET Framework 3.5 AND 4.8Microsoft · Microsoft .NET Framework 3.5 AND 4.8.1Microsoft · Microsoft .NET Framework 4.6.2Microsoft · Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2Microsoft · Microsoft .NET Framework 4.8
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Microsoft .NET Framework 2.0 Service Pack 2

In the same product, most dangerous first.

CVE-2020-0646CRITICALCVE-2020-0646EPSS 99.2%KEVCVE-2020-1147HIGHCVE-2020-1147EPSS 95.8%KEVCVE-2023-36899HIGHASP.NET Elevation of Privilege VulnerabilityEPSS 76.7%CVE-2020-0605—CVE-2020-0605EPSS 18.4%CVE-2020-0606—CVE-2020-0606EPSS 18.3%CVE-2019-0613—CVE-2019-0613EPSS 15.4%