7.5
High
CVE-2020-1045 A security feature bypass vulnerability exists in the way Microsoft ASP.NET Core parses encoded cookie names. The…
Description
<p>A security feature bypass vulnerability exists in the way Microsoft ASP.NET Core parses encoded cookie names.</p> <p>The ASP.NET Core cookie parser decodes entire cookie strings which could allow a malicious attacker to set a second cookie with the name being percent encoded.</p> <p>The security update addresses the vulnerability by fixing the way the ASP.NET Core cookie parser handles encoded names.</p>
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| ASP.NET Core 2.1 2.0 | 2.0 → latest | No fix stated |
| ASP.NET Core 3.1 3.0 | 3.0 → latest | No fix stated |
Other CVEs of ASP.NET Core 2.1
The 5 CVEs of ASP.NET Core 2.1 →
CVE-2023-38180
Microsoft .NET Core and Visual Studio Denial-of-Service Vulnerability
7.5
High
CVE-2023-35391
ASP.NET Core SignalR and Visual Studio Information Disclosure Vulnerability
6.2
Medium
CVE-2021-34532
ASP.NET Core and Visual Studio Information Disclosure Vulnerability
5.5
Medium
CVE-2020-1597
A denial of service vulnerability exists when ASP.NET Core improperly handles web requests
Not rated