<p>A security feature bypass vulnerability exists in the way Microsoft ASP.NET Core parses encoded cookie names.</p> <p>The ASP.NET Core cookie parser decodes entire cookie strings which could allow a malicious attacker to set a second cookie with the name being percent encoded.</p> <p>The security update addresses the vulnerability by fixing the way the ASP.NET Core cookie parser handles encoded names.</p>
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade dotnet-runtime-3.1Upgrade netstandard-targeting-pack-2.1Upgrade dotnet-apphost-pack-3.1Upgrade dotnetUpgrade dotnet-sdk-3.1Upgrade aspnetcore-targeting-pack-3.1Upgrade dotnet-apphost-pack-3.1-debuginfoUpgrade aspnetcore-runtime-3.1Upgrade dotnet3.1-debuginfoUpgrade dotnet-runtime-3.1-debuginfoUpgrade dotnet-templates-3.1Upgrade dotnet-hostfxr-3.1-debuginfoUpgrade dotnet-targeting-pack-3.1Upgrade dotnet-hostfxr-3.1Upgrade dotnet3.1-debugsourceUpgrade dotnet-host-debuginfoUpgrade dotnet-hostUpgrade dotnet-sdk-3.1-debuginfo | Sep 9, 2020 | Sep 8, 2020 |
| Oracle_linux | — | Upgrade dotnet-apphost-pack-3.1Upgrade dotnet-targeting-pack-3.1Upgrade dotnet-hostfxr-3.1Upgrade dotnet-runtime-3.1Upgrade dotnetUpgrade dotnet-templates-3.1Upgrade aspnetcore-runtime-3.1Upgrade netstandard-targeting-pack-2.1Upgrade dotnet-sdk-3.1Upgrade dotnet-hostUpgrade aspnetcore-targeting-pack-3.1 | Sep 12, 2020 | Jul 1, 2020 |
| Redhat_linux | — | Upgrade dotnet-hostUpgrade dotnet-runtime-3.1Upgrade dotnet-sdk-3.1Upgrade dotnet-apphost-pack-3.1Upgrade dotnet3.1-debugsourceUpgrade dotnet-sdk-3.1-debuginfoUpgrade aspnetcore-runtime-3.1Upgrade dotnet-hostfxr-3.1-debuginfoUpgrade dotnet3.1-debuginfoUpgrade dotnet-runtime-3.1-debuginfoUpgrade netstandard-targeting-pack-2.1Upgrade dotnet-templates-3.1Upgrade dotnet-host-debuginfoUpgrade dotnet-targeting-pack-3.1Upgrade dotnetUpgrade dotnet-apphost-pack-3.1-debuginfoUpgrade aspnetcore-targeting-pack-3.1Upgrade dotnet-hostfxr-3.1 | Sep 9, 2020 | Sep 8, 2020 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jul 2, 2025 | Sep 11, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub