CVE-2020-1045high

CVE-2020-1045: falha de alta gravidade em Microsoft ASP.NET Core 2.1

Microsoft ASP.NET Core Security Feature Bypass Vulnerability

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar ASP.NET Core+ Monitorar Microsoft.AspNetCore.App.Runtime.win-x64

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.5epss 5.9%
<p>A security feature bypass vulnerability exists in the way Microsoft ASP.NET Core parses encoded cookie names.</p> <p>The ASP.NET Core cookie parser decodes entire cookie strings which could allow a malicious attacker to set a second cookie with the name being percent encoded.</p> <p>The security update addresses the vulnerability by fixing the way the ASP.NET Core cookie parser handles encoded names.</p>
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:P/RL:O/RC:C
Produtos afetados
Microsoft · ASP.NET Core 2.1Microsoft · ASP.NET Core 3.1
CVEs relacionadas — Microsoft ASP.NET Core 2.1

No mesmo produto, das mais perigosas para as menos.

CVE-2023-38180HIGH.NET and Visual Studio Denial of Service VulnerabilityEPSS 14.1%KEVCVE-2020-1597—ASP.NET Core Denial of Service VulnerabilityEPSS 6.6%CVE-2020-1161—ASP.NET Core Denial of Service VulnerabilityEPSS 5.3%CVE-2021-1723HIGHASP.NET Core and Visual Studio Denial of Service VulnerabilityEPSS 5.3%CVE-2023-35391MEDIUMASP.NET Core SignalR and Visual Studio Information Disclosure VulnerabilityEPSS 1.9%CVE-2021-34532MEDIUMASP.NET Core and Visual Studio Information Disclosure VulnerabilityEPSS 1.2%