Lucene search

[email protected]CVE-2020-1045

HistorySep 11, 2020 - 5:15 p.m.

CVE-2020-1045

2020-09-1117:15:00

NVD-CWE-noinfo

[email protected]

web.nvd.nist.gov

125

cve-2020-1045

microsoft

asp.net core

security feature bypass

vulnerability

nvd

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

7.2 High

AI Score

Confidence

High

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

0.002 Low

EPSS

Percentile

64.3%

JSON

A security feature bypass vulnerability exists in the way Microsoft ASP.NET Core parses encoded cookie names.
The ASP.NET Core cookie parser decodes entire cookie strings which could allow a malicious attacker to set a second cookie with the name being percent encoded.
The security update addresses the vulnerability by fixing the way the ASP.NET Core cookie parser handles encoded names.

VendorProductVersionCPE
microsoftasp.net_core_2.12.0cpe:2.3:a:microsoft:asp.net_core_2.1:2.0:*:*:*:*:*:*:*
microsoftasp.net_core_3.13.0cpe:2.3:a:microsoft:asp.net_core_3.1:3.0:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
microsoft	asp.net_core_2.1	2.0	cpe:2.3:a:microsoft:asp.net_core_2.1:2.0:::::::*
microsoft	asp.net_core_3.1	3.0	cpe:2.3:a:microsoft:asp.net_core_3.1:3.0:::::::*