GitHub Advisoryadvisory · NuGet

GHSA-24mc-gc52-47jv ICG.AspNetCore.Utilities.CloudStorage's Secure Token Durations Different Than Expected

MEDIUM Published 2024-10-30 Modified 2024-10-30 Official page ↗
Aliases
CVE-2024-50353
Ecosystem
NuGet
Packages
ICG.AspNetCore.Utilities.CloudStorage
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-284
Reviewed
2024-10-30

Affected packages

• NuGet ICG.AspNetCore.Utilities.CloudStorage: < 8.0.0 → fixed in 8.0.0

Description

Impact Users of this library that set a duration for a SAS Uri with a value other than 1 hour may have generated a URL with a duration that is longer, or shorter than desired. Users not implemented SAS Uri's are unaffected. Patches This issue was resolved in version 8.0.0 of the library, all users should update to this version ASAP. Workarounds None

Related

Alias · CVE (1)

  • CVE-2024-50353 ICG.AspNetCore.Utilities.CloudStorage is a collection of cloud storage utilities to assist with the management of files for cloud upload. vulnerability

Weakness · CWE (1)

  • CWE-284 Improper Access Control weakness

References