CVE-2020-1108: microsoft microsoft .net framework 2.0 service pack 2
Vulnerability summary
CVE-2020-1108 is a high (CVSS 7.5) vulnerability in microsoft microsoft .net framework 2.0 service pack 2. EPSS estimates a 6.46% chance of exploitation in the next 30 days, higher than 93.6% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 2Timeline
- 21-05-2020PublishedVulnerability first disclosed.
- 19-08-2026Last modifiedVulnerability information updated.
Description
A denial of service vulnerability exists when .NET Core or .NET Framework improperly handles web requests. An attacker who successfully exploited this vulnerability could cause a denial of service against a .NET Core or .NET Framework web application. The vulnerability can be exploited remotely, without authentication. A remote unauthenticated attacker could exploit this vulnerability by issuing specially crafted requests to the .NET Core or .NET Framework application. The update addresses the vulnerability by correcting how the .NET Core or .NET Framework web application handles web requests.
CVSS metrics
4 scores · 3 sources · 2 versions- OSV · Red hatEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · NugetEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
6.46%
Chance of exploitation in the next 30 days
Percentile
94%
Versus all other CVEs
30-day change
+0.21 pp
From 6.25% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Redhat48 products
- aspnetcore-runtime-3.1< 0:3.1.5-2.el8_2
- aspnetcore-targeting-pack-3.1< 0:3.1.5-2.el8_2
- dotnet< 0:2.1.514-2.el8_2 | < 0:3.1.105-2.el8_2 | < 0:2.1.515-1.el8_2
- dotnet-apphost-pack-3.1< 0:3.1.5-2.el8_2
- dotnet-apphost-pack-3.1-debuginfo< 0:3.1.5-2.el8_2
Microsoft29 products
- microsoft .net framework 2.0 service pack 2≥ 2.0.0, < publication
- microsoft .net framework 3.0 service pack 2≥ 3.0.0, < publication
- microsoft .net framework 3.5≥ 3.5.0, < publication
- microsoft .net framework 3.5 and 4.6.2/4.7/4.7.1/4.7.2≥ 3.0.0.0, < publication
- microsoft .net framework 3.5 and 4.6/4.6.1/4.6.2≥ 3.5.0, < publication
NuGet12 products
- Microsoft.NETCore.App≥ 2.1.0, < 2.1.18
- Microsoft.NETCore.App.Runtime.linux-arm≥ 3.1.0, < 3.1.4
- Microsoft.NETCore.App.Runtime.linux-arm64≥ 3.1.0, < 3.1.4
- Microsoft.NETCore.App.Runtime.linux-musl-arm64≥ 3.1.0, < 3.1.4
- Microsoft.NETCore.App.Runtime.linux-musl-x64≥ 3.1.0, < 3.1.4
3 vendors · 89 products
References
20 links
- portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1108X Refsource MISCX TransferredARTICLEWEBPatchVendor Advisory
