Not rated
CVE-2020-1597 A denial of service vulnerability exists when ASP.NET Core improperly handles web requests
Description
A denial of service vulnerability exists when ASP.NET Core improperly handles web requests. An attacker who successfully exploited this vulnerability could cause a denial of service against an ASP.NET Core web application. The vulnerability can be exploited remotely, without authentication. A remote unauthenticated attacker could exploit this vulnerability by issuing specially crafted requests to the ASP.NET Core application. The update addresses the vulnerability by correcting how the ASP.NET Core web application handles web requests.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| ASP.NET Core 2.1 2.0 | 2.0 → latest | No fix stated |
| ASP.NET Core 3.1 3.0 | 3.0 → latest | No fix stated |
| Microsoft Visual Studio 2019 version 16.4 (includes 16.0 - 16.3) 16.0 | 16.0 → latest | No fix stated |
| Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8) 15.9 | 15.9.0 → latest | No fix stated |
| Microsoft Visual Studio 2019 version 16.0 16.0 | 16.0 → latest | No fix stated |
| Microsoft Visual Studio 2019 version 16.7 (includes 16.0 – 16.6) 16.0 | 16.0.0 → latest | No fix stated |
References
- portal.msrc.microsoft.com portal.msrc.microsoft.com
- FEDORA-2020-cad5d17c6d lists.fedoraproject.org
- FEDORA-2020-9ddf1aa50b lists.fedoraproject.org
Timeline
- Published
- Last modified
Other CVEs of ASP.NET Core 2.1
The 5 CVEs of ASP.NET Core 2.1 →
CVE-2023-38180
Microsoft .NET Core and Visual Studio Denial-of-Service Vulnerability
7.5
High
CVE-2023-35391
ASP.NET Core SignalR and Visual Studio Information Disclosure Vulnerability
6.2
Medium
CVE-2021-34532
ASP.NET Core and Visual Studio Information Disclosure Vulnerability
5.5
Medium
CVE-2020-1045
A security feature bypass vulnerability exists in the way Microsoft ASP.NET Core parses encoded cookie names. The…
7.5
High