Vulnerabilities > CVE-2020-1045

CVSS 7.5 - HIGH

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

NONE

Integrity impact

HIGH

Availability impact

NONE

network

low complexity

microsoft

fedoraproject

redhat

NVD

Published: 2020-09-11

Updated: 2023-12-31

Summary

A security feature bypass vulnerability exists in the way Microsoft ASP.NET Core parses encoded cookie names. The ASP.NET Core cookie parser decodes entire cookie strings which could allow a malicious attacker to set a second cookie with the name being percent encoded. The security update addresses the vulnerability by fixing the way the ASP.NET Core cookie parser handles encoded names.

Vulnerable Configurations

Part	Description	Count
Application	Microsoft Microsoft Asp.Net Core 2.1 Microsoft Asp.Net Core 2.1.0 Microsoft Asp.Net Core 2.1.1 Microsoft Asp.Net Core 2.1.2 Microsoft Asp.Net Core 2.1.3 Microsoft Asp.Net Core 2.1.4 Microsoft Asp.Net Core 2.1.5 Microsoft Asp.Net Core 2.1.6 Microsoft Asp.Net Core 2.1.7 Microsoft Asp.Net Core 2.1.8 Microsoft Asp.Net Core 2.1.9 Microsoft Asp.Net Core 2.1.10 Microsoft Asp.Net Core 2.1.11 Microsoft Asp.Net Core 2.1.12 Microsoft Asp.Net Core 2.1.13 Microsoft Asp.Net Core 2.1.14 Microsoft Asp.Net Core 2.1.15 Microsoft Asp.Net Core 2.1.16 Microsoft Asp.Net Core 2.1.17 Microsoft Asp.Net Core 2.1.18 Microsoft Asp.Net Core 2.1.19 Microsoft Asp.Net Core 2.1.20 Microsoft Asp.Net Core 2.1.21 Microsoft Asp.Net Core 3.1 Microsoft Asp.Net Core 3.1.0 Microsoft Asp.Net Core 3.1.1 Microsoft Asp.Net Core 3.1.2 Microsoft Asp.Net Core 3.1.3 Microsoft Asp.Net Core 3.1.4 Microsoft Asp.Net Core 3.1.5 Microsoft Asp.Net Core 3.1.6 Microsoft Asp.Net Core 3.1.7	32
OS	Fedoraproject Fedoraproject Fedora 32 Fedoraproject Fedora 33	2
OS	Redhat Redhat Enterprise Linux 8.0 Redhat Enterprise Linux EUS 8.2 Redhat Enterprise Linux EUS 8.4 Redhat Enterprise Linux EUS 8.6 Redhat Enterprise Linux AUS 8.2 Redhat Enterprise Linux AUS 8.4 Redhat Enterprise Linux AUS 8.6 Redhat Enterprise Linux TUS 8.2 Redhat Enterprise Linux TUS 8.4 Redhat Enterprise Linux TUS 8.6	10

Vulnerabilities > CVE-2020-1045 {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Vulnerabilities","item":"https://cyber.vumetric.com/vulns/"},{"@type":"ListItem","position":2,"name":"CVE-2020-1045"}]}

Summary

Vulnerable Configurations

References

Vulnerabilities > CVE-2020-1045