Vulnerability Description
A denial of service vulnerability exists when .NET Core or .NET Framework improperly handles web requests. An attacker who successfully exploited this vulnerability could cause a denial of service against a .NET Core or .NET Framework web application. The vulnerability can be exploited remotely, without authentication. A remote unauthenticated attacker could exploit this vulnerability by issuing specially crafted requests to the .NET Core or .NET Framework application. The update addresses the vulnerability by correcting how the .NET Core or .NET Framework web application handles web requests.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Microsoft | .Net | 5.0 |
| Microsoft | .Net Core | >= 2.1, <= 2.1.18 |
| Microsoft | .Net Framework | 2.0 |
| Microsoft | Windows Server 2008 | - |
| Microsoft | Windows 8.1 | - |
| Microsoft | Windows Server 2012 | - |
| Microsoft | Windows 10 | 1607 |
| Microsoft | Windows Server 2016 | All versions |
| Microsoft | Windows Server 2019 | - |
| Microsoft | Windows 7 | - |
| Microsoft | Windows Rt 8.1 | - |
| Microsoft | Visual Studio 2017 | 15.9 |
| Microsoft | Visual Studio 2019 | 16.0 |
| Microsoft | Powershell | 7.0 |
| Microsoft | Powershell Core | 6.2 |
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2020-1108
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1108PatchVendor Advisory
FAQ
What is CVE-2020-1108?
CVE-2020-1108 is a vulnerability with a CVSS score of 7.5 (HIGH). A denial of service vulnerability exists when .NET Core or .NET Framework improperly handles web requests. An attacker who successfully exploited this vulnerability could cause a denial of service aga...
How severe is CVE-2020-1108?
CVE-2020-1108 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2020-1108?
Check the references section above for vendor advisories and patch information. Affected products include: Microsoft .Net, Microsoft .Net Core, Microsoft .Net Framework, Microsoft Windows Server 2008, Microsoft Windows 8.1.