<p>A security feature bypass vulnerability exists in the way Microsoft ASP.NET Core parses encoded cookie names.</p> <p>The ASP.NET Core cookie parser decodes entire cookie strings which could allow a malicious attacker to set a second cookie with the name being percent encoded.</p> <p>The security update addresses the vulnerability by fixing the way the ASP.NET Core cookie parser handles encoded names.</p>
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade dotnet-targeting-pack-3.1Upgrade dotnet-hostUpgrade dotnet-sdk-3.1-debuginfoUpgrade dotnet3.1-debugsourceUpgrade dotnet-host-debuginfoUpgrade dotnet-hostfxr-3.1-debuginfoUpgrade dotnet-hostfxr-3.1Upgrade dotnet-runtime-3.1-debuginfoUpgrade dotnet-apphost-pack-3.1-debuginfoUpgrade dotnet3.1-debuginfoUpgrade dotnet-templates-3.1Upgrade dotnet-apphost-pack-3.1Upgrade aspnetcore-targeting-pack-3.1Upgrade dotnet-runtime-3.1Upgrade dotnet-sdk-3.1Upgrade dotnetUpgrade netstandard-targeting-pack-2.1Upgrade aspnetcore-runtime-3.1 | Sep 9, 2020 | Sep 8, 2020 |
| Oracle_linux | — | Upgrade dotnet-templates-3.1Upgrade dotnet-sdk-3.1Upgrade dotnetUpgrade netstandard-targeting-pack-2.1Upgrade aspnetcore-runtime-3.1Upgrade dotnet-runtime-3.1Upgrade dotnet-hostUpgrade aspnetcore-targeting-pack-3.1Upgrade dotnet-apphost-pack-3.1Upgrade dotnet-hostfxr-3.1Upgrade dotnet-targeting-pack-3.1 | Sep 12, 2020 | Jul 1, 2020 |
| Redhat_linux | — | Upgrade dotnet-sdk-3.1-debuginfoUpgrade dotnet3.1-debugsourceUpgrade dotnet-runtime-3.1Upgrade dotnet-apphost-pack-3.1Upgrade dotnet-hostfxr-3.1-debuginfoUpgrade dotnet3.1-debuginfoUpgrade dotnet-sdk-3.1Upgrade aspnetcore-runtime-3.1Upgrade dotnet-hostUpgrade dotnet-host-debuginfoUpgrade dotnet-runtime-3.1-debuginfoUpgrade dotnet-hostfxr-3.1Upgrade netstandard-targeting-pack-2.1Upgrade dotnetUpgrade dotnet-templates-3.1Upgrade dotnet-apphost-pack-3.1-debuginfoUpgrade dotnet-targeting-pack-3.1Upgrade aspnetcore-targeting-pack-3.1 | Sep 9, 2020 | Sep 8, 2020 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jul 2, 2025 | Sep 11, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub