VYPR
← All advisories
High severity7.5NVD Advisory· Published Sep 11, 2020· Updated Jun 17, 2026

CVE-2020-1045

CVE-2020-1045

Description

A security feature bypass vulnerability exists in the way Microsoft ASP.NET Core parses encoded cookie names. The ASP.NET Core cookie parser decodes entire cookie strings which could allow a malicious attacker to set a second cookie with the name being percent encoded. The security update addresses the vulnerability by fixing the way the ASP.NET Core cookie parser handles encoded names.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
Microsoft.AspNetCore.HttpNuGet
< 2.1.222.1.22
Microsoft.AspNetCore.AppNuGet
< 2.1.222.1.22
Microsoft.OwinNuGet
< 4.1.14.1.1
Microsoft.AspNetCore.App.Runtime.linux-armNuGet
>= 3.1.0, < 3.1.83.1.8
Microsoft.AspNetCore.App.Runtime.linux-arm64NuGet
>= 3.1.0, < 3.1.83.1.8
Microsoft.AspNetCore.App.Runtime.linux-musl-x64NuGet
>= 3.1.0, < 3.1.83.1.8
Microsoft.AspNetCore.App.Runtime.linux-x64NuGet
>= 3.1.0, < 3.1.83.1.8
Microsoft.AspNetCore.App.Runtime.osx-x64NuGet
>= 3.1.0, < 3.1.83.1.8
Microsoft.AspNetCore.App.Runtime.win-armNuGet
>= 3.1.0, < 3.1.83.1.8
Microsoft.AspNetCore.App.Runtime.win-x64NuGet
>= 3.1.0, < 3.1.83.1.8
Microsoft.AspNetCore.App.Runtime.win-x86NuGet
>= 3.1.0, < 3.1.83.1.8
Microsoft.AspNetCore.App.Runtime.linux-musl-arm64NuGet
>= 3.1.0, < 3.1.83.1.8
Microsoft.AspNetCore.App.Runtime.win-arm64NuGet
>= 3.1.5, < 3.1.83.1.8

Affected products

29

Patches

Vulnerability mechanics

References

17

News mentions

0

No linked articles in our index yet.