What’s Vulnerable › Vulnerabilities

CVE-2020-1045: Microsoft ASP.NET Core Security Feature Bypass Vulnerability

Description

<p>A security feature bypass vulnerability exists in the way Microsoft ASP.NET Core parses encoded cookie names.</p> <p>The ASP.NET Core cookie parser decodes entire cookie strings which could allow a malicious attacker to set a second cookie with the name being percent encoded.</p> <p>The security update addresses the vulnerability by fixing the way the ASP.NET Core cookie parser handles encoded names.</p>

Affected products

How to fix

Upgrade to a fixed version: Microsoft .NET Core 3.1.8; Microsoft ASP.NET Core 2.1 publication; Microsoft ASP.NET Core 3.1 publication. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2020-1045 or the next vulnerability affects your stack