<p>A security feature bypass vulnerability exists in the way Microsoft ASP.NET Core parses encoded cookie names.</p> <p>The ASP.NET Core cookie parser decodes entire cookie strings which could allow a malicious attacker to set a second cookie with the name being percent encoded.</p> <p>The security update addresses the vulnerability by fixing the way the ASP.NET Core cookie parser handles encoded names.</p>
History

Mon, 18 Nov 2024 17:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}


cve-icon MITRE

Status: PUBLISHED

Assigner: microsoft

Published: 2020-09-11T00:00:00

Updated: 2024-11-18T16:25:38.621Z

Reserved: 2019-11-04T00:00:00

Link: CVE-2020-1045

cve-icon Vulnrichment

Updated: 2024-08-04T06:25:01.041Z

cve-icon NVD

Status : Modified

Published: 2020-09-11T17:15:18.307

Modified: 2024-11-21T05:09:37.813

Link: CVE-2020-1045

cve-icon Redhat

Severity : Important

Publid Date: 2020-07-01T00:00:00Z

Links: CVE-2020-1045 - Bugzilla