ASP.NET Security Feature Bypass Vulnerability
nvd.nist.gov
ASP.NET Security Feature Bypass Vulnerability
1–10 of 57 posts
Re: ASP.NET Security Feature Bypass Vulnerability
#2[deleted]
Re: ASP.NET Security Feature Bypass Vulnerability
#3Note that this affects ".net core", not ".net framework"
https://msrc.microsoft.com/update-guide/vulnerability/CVE-20...
Re: ASP.NET Security Feature Bypass Vulnerability
#49.9 feels like the teacher who never gives out 10/10 or A
Re: ASP.NET Security Feature Bypass Vulnerability
#5I guess this is the kind of CVE that will make CISOs in BigCorps scream "fix it now!!" to everyone down the chain, right?
Re: ASP.NET Security Feature Bypass Vulnerability
#6Wow wonder how it was discovered. Looks like it’s been around for a while.
Re: ASP.NET Security Feature Bypass Vulnerability
#7Note that this affects ".net core", not ".net framework" https://msrc.microsoft.com/update-guide/vulnerability/CVE-20...
There is no .NET Core or .NET Framework since .NET 5.0 in 2020. Maybe you mean ASP.NET Core, but then there is no ASP.NET Framework so the comment still does not make sense to me.
The vulnerable component is ASP.NET Core, which did not change name when .NET dropped the Core name to distinguish it from legacy ASP.NET.
--- edit: cut here - the sentence below is incorrect! ---
If somehow you were still using legacy ASP.NET / Framework 4.8 etc, you have much bigger problems - legacy ASP.NET has been unsupported since 2022 so will definitely not be receiving security updates.
Re: ASP.NET Security Feature Bypass Vulnerability
#8Interesting that they put it as 'Less likely to be exploited' but at the same time give it a 9.9 riskiness.
It sort of implies it will be quikcly under active investigation by hostile actors, and then get's raised to an urgent threat?
Re: ASP.NET Security Feature Bypass Vulnerability
#9Note that this affects ".net core", not ".net framework" https://msrc.microsoft.com/update-guide/vulnerability/CVE-20...
There is no .NET Core or .NET Framework since .NET 5.0 in 2020. Maybe you mean ASP.NET Core, but then there is no ASP.NET Framework so the comment still does not make sense to me. The vulnerable component is ASP.NET Core, which did not change name when .NET dropped the Core name to distinguish it from legacy ASP.NET. --- edit: cut here - the sentence below is incorrect! --- If somehow you were still using legacy ASP.…
The last sentence is not correct. ASP.NET is part of .NET Framework which is still supported by nature of being included with Windows, and follows its support lifecycle. https://dotnet.microsoft.com/en-us/platform/support/policy/a...
This is, IMO, a bad thing, and Microsoft needs to break this chain at some point, at least for ASP.NET. But, it is still technically supported.
Re: ASP.NET Security Feature Bypass Vulnerability
#10For context around the score https://github.com/dotnet/aspnetcore/issues/64033#issuecomme...