<p>A security feature bypass vulnerability exists in the way Microsoft ASP.NET Core parses encoded cookie names.</p> <p>The ASP.NET Core cookie parser decodes entire cookie strings which could allow a malicious attacker to set a second cookie with the name being percent encoded.</p> <p>The security update addresses the vulnerability by fixing the way the ASP.NET Core cookie parser handles encoded names.</p>
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade aspnetcore-targeting-pack-3.1Upgrade aspnetcore-runtime-3.1Upgrade dotnetUpgrade dotnet-runtime-3.1-debuginfoUpgrade dotnet3.1-debuginfoUpgrade dotnet-runtime-3.1Upgrade dotnet-sdk-3.1Upgrade dotnet-templates-3.1Upgrade dotnet-apphost-pack-3.1Upgrade dotnet-apphost-pack-3.1-debuginfoUpgrade netstandard-targeting-pack-2.1Upgrade dotnet3.1-debugsourceUpgrade dotnet-targeting-pack-3.1Upgrade dotnet-hostfxr-3.1Upgrade dotnet-hostfxr-3.1-debuginfoUpgrade dotnet-hostUpgrade dotnet-host-debuginfoUpgrade dotnet-sdk-3.1-debuginfo | Sep 9, 2020 | Sep 8, 2020 |
| Oracle_linux | — | Upgrade dotnet-targeting-pack-3.1Upgrade dotnet-apphost-pack-3.1Upgrade dotnet-hostfxr-3.1Upgrade dotnetUpgrade netstandard-targeting-pack-2.1Upgrade dotnet-runtime-3.1Upgrade aspnetcore-runtime-3.1Upgrade dotnet-sdk-3.1Upgrade dotnet-hostUpgrade dotnet-templates-3.1Upgrade aspnetcore-targeting-pack-3.1 | Sep 12, 2020 | Jul 1, 2020 |
| Redhat_linux | — | Upgrade dotnet-runtime-3.1Upgrade dotnet-hostfxr-3.1-debuginfoUpgrade dotnet3.1-debugsourceUpgrade dotnet-apphost-pack-3.1Upgrade dotnet-sdk-3.1Upgrade dotnet-hostUpgrade dotnet-sdk-3.1-debuginfoUpgrade aspnetcore-runtime-3.1Upgrade dotnet3.1-debuginfoUpgrade dotnet-apphost-pack-3.1-debuginfoUpgrade aspnetcore-targeting-pack-3.1Upgrade dotnet-targeting-pack-3.1Upgrade dotnet-hostfxr-3.1Upgrade dotnet-host-debuginfoUpgrade dotnetUpgrade dotnet-templates-3.1Upgrade dotnet-runtime-3.1-debuginfoUpgrade netstandard-targeting-pack-2.1 | Sep 9, 2020 | Sep 8, 2020 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jul 2, 2025 | Sep 11, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub