Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

CVE-2020-1476— ASP.NET and .NET Elevation of Privilege Vulnerability

EPSS 0.98% · P77
Get alerts for future matching vulnerabilitiesLog in to subscribe

I. Basic Information for CVE-2020-1476

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
ASP.NET and .NET Elevation of Privilege Vulnerability
Source: NVD (National Vulnerability Database)
Vulnerability Description
An elevation of privilege vulnerability exists when ASP.NET or .NET web applications running on IIS improperly allow access to cached files. An attacker who successfully exploited this vulnerability could gain access to restricted files. To exploit this vulnerability, an attacker would need to send a specially crafted request to an affected server. The update addresses the vulnerability by changing how ASP.NET and .NET handle requests.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Title
Microsoft ASP.NET和.NET 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Microsoft ASP.NET Core是美国微软（Microsoft）公司的一框跨平台开源框架。该框架用于构建Web应用、物联网应用和移动后端等基于云的应用程序。 Microsoft ASP.NET和.NET中存在提权漏洞。攻击者可借助特制请求利用该漏洞获取文件访问权限。以下产品及版本受到影响：Microsoft .NET Framework 2.0 SP2版本，3.5版本，3.5.1版本，4.5.2版本，4.6版本，4.6.1版本，4.6.2版本，4.7版本，4.7.1版本，4.7.2版本，4.8
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

VendorProductAffected VersionsCPESubscribe
MicrosoftMicrosoft .NET Framework 4.8 4.8.0 ~ publication cpe:2.3:a:microsoft:.net:4.8:*:*:*:*:*:*:*
MicrosoftMicrosoft .NET Framework 3.5 AND 4.8 4.8.0 ~ publication cpe:2.3:a:microsoft:.net:4.8:*:*:*:*:*:*:*
MicrosoftMicrosoft .NET Framework 2.0 Service Pack 2 2.0.0 ~ publication cpe:2.3:a:microsoft:.net:2.0:sp2:*:*:*:*:*:*
MicrosoftMicrosoft .NET Framework 4.5.2 4.0.0.0 ~ publication cpe:2.3:a:microsoft:.net_framework:4.5.2:*:*:*:*:*:*:*
MicrosoftMicrosoft .NET Framework 4.6/4.6.1/4.6.2/4.7/4.7.1/4.7.2 4.0.0.0 ~ publication cpe:2.3:a:microsoft:.net_framework:4.6:*:*:*:*:*:*:*
MicrosoftMicrosoft .NET Framework 3.5 AND 4.7.2 4.7.0 ~ publication cpe:2.3:a:microsoft:.net:4.7.2:*:*:*:*:*:*:*
MicrosoftMicrosoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 3.0.0.0 ~ publication cpe:2.3:a:microsoft:.net_framework:3.5:*:*:*:*:*:*:*
MicrosoftMicrosoft .NET Framework 3.5 AND 4.6/4.6.1/4.6.2 3.5.0 ~ publication cpe:2.3:a:microsoft:.net_framework:*:*:*:*:*:*:*:*
MicrosoftMicrosoft .NET Framework 3.5 AND 4.7.1/4.7.2 3.0 ~ publication cpe:2.3:a:microsoft:.net_framework:*:*:*:*:*:*:*:*
MicrosoftMicrosoft .NET Framework 4.6 4.0.0.0 ~ publication cpe:2.3:a:microsoft:.net_framework:4.6:*:*:*:*:*:*:*
MicrosoftMicrosoft .NET Framework 3.5 3.5.0 ~ publication cpe:2.3:a:microsoft:.net:3.5:*:*:*:*:*:*:*
MicrosoftMicrosoft .NET Framework 3.5.1 3.5.0 ~ publication cpe:2.3:a:microsoft:.net:3.5.1:*:*:*:*:*:*:*

II. Public POCs for CVE-2020-1476

#POC DescriptionSource LinkShenlong Link
AI-Generated POCPremium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2020-1476

请登录查看更多情报信息。

Same Patch Batch · Microsoft · 2020-08-17 · 121 CVEs total

CVE-2020-146710.0 CRITICALWindows Hard Link Elevation of Privilege Vulnerability
CVE-2020-15838.8 HIGHMicrosoft Word Information Disclosure Vulnerability
CVE-2020-15048.8 HIGHMicrosoft Excel Remote Code Execution Vulnerability
CVE-2020-15528.0 HIGHWindows Work Folder Service Elevation of Privilege Vulnerability
CVE-2020-15217.8 HIGHWindows Speech Runtime Elevation of Privilege Vulnerability
CVE-2020-15347.8 HIGHWindows Backup Service Elevation of Privilege Vulnerability
CVE-2020-15337.8 HIGHWindows WalletService Elevation of Privilege Vulnerability
CVE-2020-15317.8 HIGHWindows Accounts Control Elevation of Privilege Vulnerability
CVE-2020-15307.8 HIGHWindows Remote Access Elevation of Privilege Vulnerability
CVE-2020-15297.8 HIGHWindows GDI Elevation of Privilege Vulnerability
CVE-2020-15287.8 HIGHWindows Radio Manager API Elevation of Privilege Vulnerability
CVE-2020-15277.8 HIGHWindows Custom Protocol Engine Elevation of Privilege Vulnerability
CVE-2020-15267.8 HIGHWindows Network Connection Broker Elevation of Privilege Vulnerability
CVE-2020-15257.8 HIGHMedia Foundation Memory Corruption Vulnerability
CVE-2020-15247.8 HIGHWindows Speech Shell Components Elevation of Privilege Vulnerability
CVE-2020-15137.8 HIGHWindows CSC Service Elevation of Privilege Vulnerability
CVE-2020-15167.8 HIGHWindows Work Folders Service Elevation of Privilege Vulnerability
CVE-2020-15157.8 HIGHWindows Telephony Server Elevation of Privilege Vulnerability
CVE-2020-15177.8 HIGHWindows File Server Resource Management Service Elevation of Privilege Vulnerability
CVE-2020-15127.8 HIGHWindows State Repository Service Information Disclosure Vulnerability

Showing top 20 of 121 CVEs. View all on vendor page → →

IV. Related Vulnerabilities

Same product: Microsoft .NET Framework 4.8
Same vendor: Microsoft

V. Comments for CVE-2020-1476

No comments yet

Leave a comment