GSD-2020-0603
Vulnerability from gsd - Updated: 2023-12-13 01:21Details
A remote code execution vulnerability exists in ASP.NET Core software when the software fails to handle objects in memory.An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user, aka 'ASP.NET Core Remote Code Execution Vulnerability'.
Aliases
Aliases
{
"GSD": {
"alias": "CVE-2020-0603",
"description": "A remote code execution vulnerability exists in ASP.NET Core software when the software fails to handle objects in memory.An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user, aka \u0027ASP.NET Core Remote Code Execution Vulnerability\u0027.",
"id": "GSD-2020-0603",
"references": [
"https://access.redhat.com/errata/RHSA-2020:0134",
"https://access.redhat.com/errata/RHSA-2020:0130",
"https://linux.oracle.com/cve/CVE-2020-0603.html"
]
},
"gsd": {
"metadata": {
"exploitCode": "unknown",
"remediation": "unknown",
"reportConfidence": "confirmed",
"type": "vulnerability"
},
"osvSchema": {
"aliases": [
"CVE-2020-0603"
],
"details": "A remote code execution vulnerability exists in ASP.NET Core software when the software fails to handle objects in memory.An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user, aka \u0027ASP.NET Core Remote Code Execution Vulnerability\u0027.",
"id": "GSD-2020-0603",
"modified": "2023-12-13T01:21:44.487956Z",
"schema_version": "1.4.0"
}
},
"namespaces": {
"cve.org": {
"CVE_data_meta": {
"ASSIGNER": "secure@microsoft.com",
"ID": "CVE-2020-0603",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "ASP.NET Core",
"version": {
"version_data": [
{
"version_value": "2.1"
},
{
"version_value": "3.0"
},
{
"version_value": "3.1"
}
]
}
}
]
},
"vendor_name": "Microsoft"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A remote code execution vulnerability exists in ASP.NET Core software when the software fails to handle objects in memory.An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user, aka \u0027ASP.NET Core Remote Code Execution Vulnerability\u0027."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Remote Code Execution"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0603",
"refsource": "MISC",
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0603"
},
{
"name": "RHSA-2020:0130",
"refsource": "REDHAT",
"url": "https://access.redhat.com/errata/RHSA-2020:0130"
},
{
"name": "RHSA-2020:0134",
"refsource": "REDHAT",
"url": "https://access.redhat.com/errata/RHSA-2020:0134"
}
]
}
},
"gitlab.com": {
"advisories": [
{
"affected_range": "[2.1],[3.0,3.1]",
"affected_versions": "Version 2.1, all versions starting from 3.0 up to 3.1",
"cvss_v2": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
"cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"cwe_ids": [
"CWE-1035",
"CWE-787",
"CWE-937"
],
"date": "2021-07-21",
"description": "A remote code execution vulnerability exists in ASP.NET Core software when the software fails to handle objects in memory.An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user, aka \u0027ASP.NET Core Remote Code Execution Vulnerability\u0027.",
"fixed_versions": [
"3.1.1"
],
"identifier": "CVE-2020-0603",
"identifiers": [
"CVE-2020-0603"
],
"not_impacted": "All versions before 2.1, all versions after 2.1 before 3.0, all versions after 3.1",
"package_slug": "nuget/Microsoft.AspNetCore.All",
"pubdate": "2020-01-14",
"solution": "Upgrade to version 3.1.1 or above.",
"title": "Out-of-bounds Write",
"urls": [
"https://nvd.nist.gov/vuln/detail/CVE-2020-0603",
"https://github.com/aspnet/Announcements/issues/403",
"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0603",
"https://access.redhat.com/errata/RHSA-2020:0130",
"https://access.redhat.com/errata/RHSA-2020:0134"
],
"uuid": "38e9920c-42a0-4b99-b612-197ab3589506"
},
{
"affected_range": "[3.1.0,3.1.1)",
"affected_versions": "All versions starting from 3.1.0 before 3.1.1",
"cvss_v2": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
"cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"cwe_ids": [
"CWE-1035",
"CWE-78",
"CWE-787",
"CWE-937"
],
"date": "2022-10-31",
"description": "A remote code execution vulnerability exists in ASP.NET Core software when the software fails to handle objects in memory.An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user, aka \u0027ASP.NET Core Remote Code Execution Vulnerability\u0027.",
"fixed_versions": [
"3.1.1"
],
"identifier": "CVE-2020-0603",
"identifiers": [
"GHSA-655q-9gvg-q4cm",
"CVE-2020-0603"
],
"not_impacted": "All versions before 3.1.0, all versions starting from 3.1.1",
"package_slug": "nuget/Microsoft.AspNetCore.App.Runtime.linux-arm",
"pubdate": "2022-05-24",
"solution": "Upgrade to version 3.1.1 or above.",
"title": "Out-of-bounds Write",
"urls": [
"https://nvd.nist.gov/vuln/detail/CVE-2020-0603",
"https://access.redhat.com/errata/RHSA-2020:0130",
"https://access.redhat.com/errata/RHSA-2020:0134",
"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0603",
"https://github.com/aspnet/Announcements/issues/403",
"https://github.com/github/advisory-database/issues/302",
"https://github.com/advisories/GHSA-655q-9gvg-q4cm"
],
"uuid": "945ff538-5993-4a15-a990-26c59739cca5"
},
{
"affected_range": "[3.1.0,3.1.1)",
"affected_versions": "All versions starting from 3.1.0 before 3.1.1",
"cvss_v2": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
"cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"cwe_ids": [
"CWE-1035",
"CWE-78",
"CWE-787",
"CWE-937"
],
"date": "2022-10-31",
"description": "A remote code execution vulnerability exists in ASP.NET Core software when the software fails to handle objects in memory.An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user, aka \u0027ASP.NET Core Remote Code Execution Vulnerability\u0027.",
"fixed_versions": [
"3.1.1"
],
"identifier": "CVE-2020-0603",
"identifiers": [
"GHSA-655q-9gvg-q4cm",
"CVE-2020-0603"
],
"not_impacted": "All versions before 3.1.0, all versions starting from 3.1.1",
"package_slug": "nuget/Microsoft.AspNetCore.App.Runtime.linux-arm64",
"pubdate": "2022-05-24",
"solution": "Upgrade to version 3.1.1 or above.",
"title": "Out-of-bounds Write",
"urls": [
"https://nvd.nist.gov/vuln/detail/CVE-2020-0603",
"https://access.redhat.com/errata/RHSA-2020:0130",
"https://access.redhat.com/errata/RHSA-2020:0134",
"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0603",
"https://github.com/aspnet/Announcements/issues/403",
"https://github.com/github/advisory-database/issues/302",
"https://github.com/advisories/GHSA-655q-9gvg-q4cm"
],
"uuid": "d12a6ea8-000c-4256-83d1-80b9700e0102"
},
{
"affected_range": "[3.1.0,3.1.1)",
"affected_versions": "All versions starting from 3.1.0 before 3.1.1",
"cvss_v2": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
"cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"cwe_ids": [
"CWE-1035",
"CWE-78",
"CWE-787",
"CWE-937"
],
"date": "2022-10-31",
"description": "A remote code execution vulnerability exists in ASP.NET Core software when the software fails to handle objects in memory.An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user, aka \u0027ASP.NET Core Remote Code Execution Vulnerability\u0027.",
"fixed_versions": [
"3.1.1"
],
"identifier": "CVE-2020-0603",
"identifiers": [
"GHSA-655q-9gvg-q4cm",
"CVE-2020-0603"
],
"not_impacted": "All versions before 3.1.0, all versions starting from 3.1.1",
"package_slug": "nuget/Microsoft.AspNetCore.App.Runtime.linux-musl-arm64",
"pubdate": "2022-05-24",
"solution": "Upgrade to version 3.1.1 or above.",
"title": "Out-of-bounds Write",
"urls": [
"https://nvd.nist.gov/vuln/detail/CVE-2020-0603",
"https://access.redhat.com/errata/RHSA-2020:0130",
"https://access.redhat.com/errata/RHSA-2020:0134",
"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0603",
"https://github.com/aspnet/Announcements/issues/403",
"https://github.com/github/advisory-database/issues/302",
"https://github.com/advisories/GHSA-655q-9gvg-q4cm"
],
"uuid": "15491288-4aa0-43cd-8ef2-69393b7f4173"
},
{
"affected_range": "[3.1.0,3.1.1)",
"affected_versions": "All versions starting from 3.1.0 before 3.1.1",
"cvss_v2": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
"cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"cwe_ids": [
"CWE-1035",
"CWE-78",
"CWE-787",
"CWE-937"
],
"date": "2022-10-31",
"description": "A remote code execution vulnerability exists in ASP.NET Core software when the software fails to handle objects in memory.An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user, aka \u0027ASP.NET Core Remote Code Execution Vulnerability\u0027.",
"fixed_versions": [
"3.1.1"
],
"identifier": "CVE-2020-0603",
"identifiers": [
"GHSA-655q-9gvg-q4cm",
"CVE-2020-0603"
],
"not_impacted": "All versions before 3.1.0, all versions starting from 3.1.1",
"package_slug": "nuget/Microsoft.AspNetCore.App.Runtime.linux-musl-x64",
"pubdate": "2022-05-24",
"solution": "Upgrade to version 3.1.1 or above.",
"title": "Out-of-bounds Write",
"urls": [
"https://nvd.nist.gov/vuln/detail/CVE-2020-0603",
"https://access.redhat.com/errata/RHSA-2020:0130",
"https://access.redhat.com/errata/RHSA-2020:0134",
"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0603",
"https://github.com/aspnet/Announcements/issues/403",
"https://github.com/github/advisory-database/issues/302",
"https://github.com/advisories/GHSA-655q-9gvg-q4cm"
],
"uuid": "e2fb21fa-d356-4ad0-97d1-26a3693f1f86"
},
{
"affected_range": "[3.1.0,3.1.1)",
"affected_versions": "All versions starting from 3.1.0 before 3.1.1",
"cvss_v2": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
"cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"cwe_ids": [
"CWE-1035",
"CWE-78",
"CWE-787",
"CWE-937"
],
"date": "2022-10-31",
"description": "A remote code execution vulnerability exists in ASP.NET Core software when the software fails to handle objects in memory.An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user, aka \u0027ASP.NET Core Remote Code Execution Vulnerability\u0027.",
"fixed_versions": [
"3.1.1"
],
"identifier": "CVE-2020-0603",
"identifiers": [
"GHSA-655q-9gvg-q4cm",
"CVE-2020-0603"
],
"not_impacted": "All versions before 3.1.0, all versions starting from 3.1.1",
"package_slug": "nuget/Microsoft.AspNetCore.App.Runtime.linux-x64",
"pubdate": "2022-05-24",
"solution": "Upgrade to version 3.1.1 or above.",
"title": "Out-of-bounds Write",
"urls": [
"https://nvd.nist.gov/vuln/detail/CVE-2020-0603",
"https://access.redhat.com/errata/RHSA-2020:0130",
"https://access.redhat.com/errata/RHSA-2020:0134",
"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0603",
"https://github.com/aspnet/Announcements/issues/403",
"https://github.com/github/advisory-database/issues/302",
"https://github.com/advisories/GHSA-655q-9gvg-q4cm"
],
"uuid": "8a4d610b-8bf1-4224-a79b-307555729d96"
},
{
"affected_range": "[3.1.0,3.1.1)",
"affected_versions": "All versions starting from 3.1.0 before 3.1.1",
"cvss_v2": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
"cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"cwe_ids": [
"CWE-1035",
"CWE-78",
"CWE-787",
"CWE-937"
],
"date": "2022-10-31",
"description": "A remote code execution vulnerability exists in ASP.NET Core software when the software fails to handle objects in memory.An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user, aka \u0027ASP.NET Core Remote Code Execution Vulnerability\u0027.",
"fixed_versions": [
"3.1.1"
],
"identifier": "CVE-2020-0603",
"identifiers": [
"GHSA-655q-9gvg-q4cm",
"CVE-2020-0603"
],
"not_impacted": "All versions before 3.1.0, all versions starting from 3.1.1",
"package_slug": "nuget/Microsoft.AspNetCore.App.Runtime.osx-x64",
"pubdate": "2022-05-24",
"solution": "Upgrade to version 3.1.1 or above.",
"title": "Out-of-bounds Write",
"urls": [
"https://nvd.nist.gov/vuln/detail/CVE-2020-0603",
"https://access.redhat.com/errata/RHSA-2020:0130",
"https://access.redhat.com/errata/RHSA-2020:0134",
"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0603",
"https://github.com/aspnet/Announcements/issues/403",
"https://github.com/github/advisory-database/issues/302",
"https://github.com/advisories/GHSA-655q-9gvg-q4cm"
],
"uuid": "432b179c-8474-4eb8-a3f2-e1b0a9c4a2a1"
},
{
"affected_range": "[3.1.0,3.1.1)",
"affected_versions": "All versions starting from 3.1.0 before 3.1.1",
"cvss_v2": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
"cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"cwe_ids": [
"CWE-1035",
"CWE-78",
"CWE-787",
"CWE-937"
],
"date": "2022-10-31",
"description": "A remote code execution vulnerability exists in ASP.NET Core software when the software fails to handle objects in memory.An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user, aka \u0027ASP.NET Core Remote Code Execution Vulnerability\u0027.",
"fixed_versions": [
"3.1.1"
],
"identifier": "CVE-2020-0603",
"identifiers": [
"GHSA-655q-9gvg-q4cm",
"CVE-2020-0603"
],
"not_impacted": "All versions before 3.1.0, all versions starting from 3.1.1",
"package_slug": "nuget/Microsoft.AspNetCore.App.Runtime.win-arm",
"pubdate": "2022-05-24",
"solution": "Upgrade to version 3.1.1 or above.",
"title": "Out-of-bounds Write",
"urls": [
"https://nvd.nist.gov/vuln/detail/CVE-2020-0603",
"https://access.redhat.com/errata/RHSA-2020:0130",
"https://access.redhat.com/errata/RHSA-2020:0134",
"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0603",
"https://github.com/aspnet/Announcements/issues/403",
"https://github.com/github/advisory-database/issues/302",
"https://github.com/advisories/GHSA-655q-9gvg-q4cm"
],
"uuid": "e0594a35-7e78-41b3-b654-2a02f39c3dc2"
},
{
"affected_range": "[3.1.0,3.1.1)",
"affected_versions": "All versions starting from 3.1.0 before 3.1.1",
"cvss_v2": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
"cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"cwe_ids": [
"CWE-1035",
"CWE-78",
"CWE-787",
"CWE-937"
],
"date": "2022-10-31",
"description": "A remote code execution vulnerability exists in ASP.NET Core software when the software fails to handle objects in memory.An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user, aka \u0027ASP.NET Core Remote Code Execution Vulnerability\u0027.",
"fixed_versions": [
"3.1.1"
],
"identifier": "CVE-2020-0603",
"identifiers": [
"GHSA-655q-9gvg-q4cm",
"CVE-2020-0603"
],
"not_impacted": "All versions before 3.1.0, all versions starting from 3.1.1",
"package_slug": "nuget/Microsoft.AspNetCore.App.Runtime.win-x64",
"pubdate": "2022-05-24",
"solution": "Upgrade to version 3.1.1 or above.",
"title": "Out-of-bounds Write",
"urls": [
"https://nvd.nist.gov/vuln/detail/CVE-2020-0603",
"https://access.redhat.com/errata/RHSA-2020:0130",
"https://access.redhat.com/errata/RHSA-2020:0134",
"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0603",
"https://github.com/aspnet/Announcements/issues/403",
"https://github.com/github/advisory-database/issues/302",
"https://github.com/advisories/GHSA-655q-9gvg-q4cm"
],
"uuid": "ef4af269-2dd8-45c5-a0ab-8decd3411916"
},
{
"affected_range": "[3.1.0,3.1.1)",
"affected_versions": "All versions starting from 3.1.0 before 3.1.1",
"cvss_v2": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
"cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"cwe_ids": [
"CWE-1035",
"CWE-78",
"CWE-787",
"CWE-937"
],
"date": "2022-10-31",
"description": "A remote code execution vulnerability exists in ASP.NET Core software when the software fails to handle objects in memory.An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user, aka \u0027ASP.NET Core Remote Code Execution Vulnerability\u0027.",
"fixed_versions": [
"3.1.1"
],
"identifier": "CVE-2020-0603",
"identifiers": [
"GHSA-655q-9gvg-q4cm",
"CVE-2020-0603"
],
"not_impacted": "All versions before 3.1.0, all versions starting from 3.1.1",
"package_slug": "nuget/Microsoft.AspNetCore.App.Runtime.win-x86",
"pubdate": "2022-05-24",
"solution": "Upgrade to version 3.1.1 or above.",
"title": "Out-of-bounds Write",
"urls": [
"https://nvd.nist.gov/vuln/detail/CVE-2020-0603",
"https://access.redhat.com/errata/RHSA-2020:0130",
"https://access.redhat.com/errata/RHSA-2020:0134",
"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0603",
"https://github.com/aspnet/Announcements/issues/403",
"https://github.com/github/advisory-database/issues/302",
"https://github.com/advisories/GHSA-655q-9gvg-q4cm"
],
"uuid": "eacb51c8-2768-4d18-ba84-ef497091d868"
},
{
"affected_range": "[2.1.0,2.1.15),[3.0.0,3.1.0]",
"affected_versions": "All versions starting from 2.1.0 before 2.1.15, all versions starting from 3.0.0 up to 3.1.0",
"cvss_v2": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
"cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"cwe_ids": [
"CWE-1035",
"CWE-78",
"CWE-787",
"CWE-937"
],
"date": "2022-07-07",
"description": "A remote code execution vulnerability exists in ASP.NET Core software when the software fails to handle objects in memory.An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user, aka \u0027ASP.NET Core Remote Code Execution Vulnerability\u0027.",
"fixed_versions": [
"3.1.1",
"2.1.15"
],
"identifier": "CVE-2020-0603",
"identifiers": [
"GHSA-655q-9gvg-q4cm",
"CVE-2020-0603"
],
"not_impacted": "All versions before 2.1.0, all versions starting from 2.1.15 before 3.0.0, all versions after 3.1.0",
"package_slug": "nuget/Microsoft.AspNetCore.App",
"pubdate": "2022-05-24",
"solution": "Upgrade to versions 3.1.1, 2.1.15 or above.",
"title": "Out-of-bounds Write",
"urls": [
"https://nvd.nist.gov/vuln/detail/CVE-2020-0603",
"https://access.redhat.com/errata/RHSA-2020:0130",
"https://access.redhat.com/errata/RHSA-2020:0134",
"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0603",
"https://github.com/aspnet/Announcements/issues/403",
"https://github.com/github/advisory-database/issues/302",
"https://github.com/advisories/GHSA-655q-9gvg-q4cm"
],
"uuid": "ba7fe885-3fbd-40f0-b0f5-12f89a01c0c4"
},
{
"affected_range": "[1.0.0,1.0.15)",
"affected_versions": "All versions starting from 1.0.0 before 1.0.15",
"cvss_v2": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
"cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"cwe_ids": [
"CWE-1035",
"CWE-78",
"CWE-787",
"CWE-937"
],
"date": "2022-07-07",
"description": "A remote code execution vulnerability exists in ASP.NET Core software when the software fails to handle objects in memory.An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user, aka \u0027ASP.NET Core Remote Code Execution Vulnerability\u0027.",
"fixed_versions": [
"1.0.15"
],
"identifier": "CVE-2020-0603",
"identifiers": [
"GHSA-655q-9gvg-q4cm",
"CVE-2020-0603"
],
"not_impacted": "All versions before 1.0.0, all versions starting from 1.0.15",
"package_slug": "nuget/Microsoft.AspNetCore.Http.Connections",
"pubdate": "2022-05-24",
"solution": "Upgrade to version 1.0.15 or above.",
"title": "Out-of-bounds Write",
"urls": [
"https://nvd.nist.gov/vuln/detail/CVE-2020-0603",
"https://access.redhat.com/errata/RHSA-2020:0130",
"https://access.redhat.com/errata/RHSA-2020:0134",
"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0603",
"https://github.com/aspnet/Announcements/issues/403",
"https://github.com/github/advisory-database/issues/302",
"https://github.com/advisories/GHSA-655q-9gvg-q4cm"
],
"uuid": "b4c60152-7837-4681-922a-1cf390e2af72"
}
]
},
"nvd.nist.gov": {
"configurations": {
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:microsoft:asp.net_core:2.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:microsoft:asp.net_core:3.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:microsoft:asp.net_core:3.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:redhat:enterprise_linux_eus:8.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
},
"cve": {
"CVE_data_meta": {
"ASSIGNER": "secure@microsoft.com",
"ID": "CVE-2020-0603"
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "en",
"value": "A remote code execution vulnerability exists in ASP.NET Core software when the software fails to handle objects in memory.An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user, aka \u0027ASP.NET Core Remote Code Execution Vulnerability\u0027."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "en",
"value": "CWE-787"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "N/A",
"refsource": "N/A",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0603"
},
{
"name": "RHSA-2020:0130",
"refsource": "REDHAT",
"tags": [
"Third Party Advisory"
],
"url": "https://access.redhat.com/errata/RHSA-2020:0130"
},
{
"name": "RHSA-2020:0134",
"refsource": "REDHAT",
"tags": [
"Third Party Advisory"
],
"url": "https://access.redhat.com/errata/RHSA-2020:0134"
}
]
}
},
"impact": {
"baseMetricV2": {
"acInsufInfo": false,
"cvssV2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "COMPLETE",
"baseScore": 9.3,
"confidentialityImpact": "COMPLETE",
"integrityImpact": "COMPLETE",
"vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 10.0,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "HIGH",
"userInteractionRequired": true
},
"baseMetricV3": {
"cvssV3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 5.9
}
},
"lastModifiedDate": "2021-07-21T11:39Z",
"publishedDate": "2020-01-14T23:15Z"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…