CVE-2020-1045
high-risk
Published 2020-09-11
<p>A security feature bypass vulnerability exists in the way Microsoft ASP.NET Core parses encoded cookie names.</p> <p>The ASP.NET Core cookie parser decodes entire cookie strings which could allow a malicious attacker to set a second cookie with the name being percent encoded.</p> <p>The security update addresses the vulnerability by fixing the way the ASP.NET Core cookie parser handles encoded names.</p>
Do I need to act?
!
20.4% chance of exploitation in next 30 days
EPSS score — higher than 80% of all CVEs
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
7
CVSS 7.5/10
High
NETWORK
/ LOW complexity
Affected Products (13)
Affected Vendors
References (12)
Third Party Advisory
https://access.redhat.com/errata/RHSA-2020:3699
Third Party Advisory
https://security.snyk.io/vuln/SNYK-RHEL8-DOTNET-1439600
Third Party Advisory
https://access.redhat.com/errata/RHSA-2020:3699
Third Party Advisory
https://security.snyk.io/vuln/SNYK-RHEL8-DOTNET-1439600
57
/ 100
high-risk
Severity
26/34 · High
Exploitability
14/34 · Moderate
Exposure
17/34 · Moderate