CVE-2020-1476

ASP.NET and .NET Elevation of Privilege Vulnerability

Description

An elevation of privilege vulnerability exists when ASP.NET or .NET web applications running on IIS improperly allow access to cached files. An attacker who successfully exploited this vulnerability could gain access to restricted files. To exploit this vulnerability, an attacker would need to send a specially crafted request to an affected server. The update addresses the vulnerability by changing how ASP.NET and .NET handle requests.

5.5

CVSS

Severity: Medium

CVSS 3.1 •

CVSS 2.0 •

EPSS 1.12% Top 25%

Vendor Advisory microsoft.com

Affected: Microsoft Microsoft .NET Framework 4.8

Affected: Microsoft Microsoft .NET Framework 3.5 AND 4.8

Affected: Microsoft Microsoft .NET Framework 2.0 Service Pack 2

Affected: Microsoft Microsoft .NET Framework 4.5.2

Affected: Microsoft Microsoft .NET Framework 4.6/4.6.1/4.6.2/4.7/4.7.1/4.7.2

Affected: Microsoft Microsoft .NET Framework 3.5 AND 4.7.2

Affected: Microsoft Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2

Affected: Microsoft Microsoft .NET Framework 3.5 AND 4.6/4.6.1/4.6.2

Affected: Microsoft Microsoft .NET Framework 3.5 AND 4.7.1/4.7.2

Affected: Microsoft Microsoft .NET Framework 4.6

Affected: Microsoft Microsoft .NET Framework 3.5

Affected: Microsoft Microsoft .NET Framework 3.5.1

References

Link	Tags
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1476	patch vendor advisory

Frequently Asked Questions

What is the severity of CVE-2020-1476?: CVE-2020-1476 has been scored as a medium severity vulnerability.
How to fix CVE-2020-1476?: To fix CVE-2020-1476, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2020-1476 being actively exploited in the wild?: It is possible that CVE-2020-1476 is being exploited or will be exploited in a near future based on public information. According to its EPSS score, there is a ~1% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2020-1476?: CVE-2020-1476 affects Microsoft Microsoft .NET Framework 4.8, Microsoft Microsoft .NET Framework 3.5 AND 4.8, Microsoft Microsoft .NET Framework 2.0 Service Pack 2, Microsoft Microsoft .NET Framework 4.5.2, Microsoft Microsoft .NET Framework 4.6/4.6.1/4.6.2/4.7/4.7.1/4.7.2, Microsoft Microsoft .NET Framework 3.5 AND 4.7.2, Microsoft Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2, Microsoft Microsoft .NET Framework 3.5 AND 4.6/4.6.1/4.6.2, Microsoft Microsoft .NET Framework 3.5 AND 4.7.1/4.7.2, Microsoft Microsoft .NET Framework 4.6, Microsoft Microsoft .NET Framework 3.5, Microsoft Microsoft .NET Framework 3.5.1.