Microsoft ASP.NET and .NET Elevation of Privilege Vulnerability
| VCSA ID | VCSA-12 |
| CVSS SCORE | 8.7 |
| AFFECTED VENDORS | Microsoft |
| AFFECTED PRODUCTS | ASP.NET and .NET Framework |
| AFFECTED VERSIONS | N/A |
| DESCRIPTION | An elevation of privilege vulnerability exists when ASP.NET or .NET web applications running on IIS improperly allow access to cached files. An attacker who successfully exploited this vulnerability could gain access to restricted files. |
| SOLUTION | Update to latest version |
| CREDIT | rskvp93 (Phạm Văn Khánh) |
| REPORT TIME | 2020-04-10 |
| PUBLISHED TIME | 2021-01-01 |
| DISCLOSURE TIMELINE | • 10/04/2020 – Reported the vulnerability to the vendor • 11/08/2020 – The vendor publish the patch |
| REFERENCES | • https://msrc.microsoft.com/update-guide/vulnerability/CVE-2020-1476 |