CVEvulnerability

CVE-2020-1045

7.5 HIGH Published 2020-09-11 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2020-09-11
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS 3.1 ([email protected])
7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS 2.0 ([email protected])
5.0 MEDIUM — AV:N/AC:L/Au:N/C:N/I:P/A:N

Description

<p>A security feature bypass vulnerability exists in the way Microsoft ASP.NET Core parses encoded cookie names.</p> <p>The ASP.NET Core cookie parser decodes entire cookie strings which could allow a malicious attacker to set a second cookie with the name being percent encoded.</p> <p>The security update addresses the vulnerability by fixing the way the ASP.NET Core cookie parser handles encoded names.</p>

Affected configurations

• microsoft asp.net core (>= 2.1 <= 2.1.21) • microsoft asp.net core (>= 3.1 < 3.1.8) • fedoraproject fedora 32 • fedoraproject fedora 33 • redhat enterprise linux 8.0 • redhat enterprise linux aus 8.2 • redhat enterprise linux aus 8.4 • redhat enterprise linux aus 8.6 • redhat enterprise linux eus 8.2 • redhat enterprise linux eus 8.4 • redhat enterprise linux eus 8.6 • redhat enterprise linux tus 8.2 • redhat enterprise linux tus 8.4 • redhat enterprise linux tus 8.6

References