CVE-2020-1045: fedoraproject fedora
Vulnerability summary
CVE-2020-1045 is a high (CVSS 7.5) vulnerability in fedoraproject fedora. EPSS estimates a 5.93% chance of exploitation in the next 30 days, higher than 93.1% of scored vulnerabilities.
Timeline
- 11-09-2020PublishedVulnerability first disclosed.
- 18-11-2024Last modifiedVulnerability information updated.
Description
<p>A security feature bypass vulnerability exists in the way Microsoft ASP.NET Core parses encoded cookie names.</p> <p>The ASP.NET Core cookie parser decodes entire cookie strings which could allow a malicious attacker to set a second cookie with the name being percent encoded.</p> <p>The security update addresses the vulnerability by fixing the way the ASP.NET Core cookie parser handles encoded names.</p>
CVSS metrics
5 scores · 4 sources · 2 versions- OSV · Red hatEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- OSV · NugetEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
EPSS trend
Probability
5.93%
Chance of exploitation in the next 30 days
Percentile
93%
Versus all other CVEs
30-day change
0.00 pp
From 5.93% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Redhat35 products
- enterprise_linux8.0
- enterprise_linux_aus8.2 | 8.4 | 8.6
- enterprise_linux_eus8.2 | 8.4 | 8.6
- enterprise_linux_tus8.2 | 8.4 | 8.6
- aspnetcore-runtime-3.1< 0:3.1.8-2.el8_2
NuGet13 products
- Microsoft.AspNetCore.App< 2.1.22
- Microsoft.AspNetCore.App.Runtime.linux-arm≥ 3.1.0, < 3.1.8
- Microsoft.AspNetCore.App.Runtime.linux-arm64≥ 3.1.0, < 3.1.8
- Microsoft.AspNetCore.App.Runtime.linux-musl-arm64≥ 3.1.0, < 3.1.8
- Microsoft.AspNetCore.App.Runtime.linux-musl-x64≥ 3.1.0, < 3.1.8
Microsoft3 products
- asp.net_core≥ 2.1, ≤ 2.1.21 | ≥ 3.1, < 3.1.8
- asp.net core 2.1≥ 2.0, < publication
- asp.net core 3.1≥ 3.0, < publication
Fedoraproject1 product
- fedoraEOL32 | 33
4 vendors · 52 products
References
24 links
portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1045ARTICLEWEBPatchVendor Advisory- lists.fedoraproject.org/archives/…Vendor Advisory
- lists.fedoraproject.org/archives/…Vendor Advisory
- github.com/dotnet/core/blob/main/release-notes/3.1/3.1.8/3.1.8.mdWEBRelease NotesThird Party Advisory
