CWE-520

.NET Misconfiguration: Use of Impersonation

VariantIncomplete

Description

Allowing a .NET application to run at potentially escalated levels of access to the underlying operating and file systems can be dangerous and result in various forms of attacks.

.NET server applications can optionally execute using the identity of the user authenticated to the client. The intention of this functionality is to bypass authentication and access control checks within the .NET application code. Authentication is done by the underlying web server (Microsoft Internet Information Service IIS), which passes the authenticated token, or unauthenticated anonymous token, to the .NET application. Using the token to impersonate the client, the application then relies on the settings within the NTFS directories and files to control access. Impersonation enables the application, on the server running the .NET application, to both execute code and access resources in the context of the authenticated and authorized user.

Hierarchy (View 1000)

Parents

CWE-266

Children

none

CVEs mapped to this weakness (3)

CVE	Vendor / Product	Sev	Risk	CVSS	EPSS	Published	Description
CVE-2019-25608	Entersrl Iperius Backup	Hig	0.55	8.4	0.00	Mar 22, 2026	Iperius Backup 6.1.0 contains a privilege escalation vulnerability that allows low-privilege users to execute arbitrary programs with elevated privileges by creating backup jobs. Attackers can configure backup jobs to execute malicious batch files or programs before or after…
CVE-2026-2450	—	Hig	0.48	—	0.00	Apr 14, 2026	.NET misconfiguration: use of impersonation vulnerability in upKeeper Solutions upKeeper Instant Privilege Access allows Hijacking a Privileged Thread of Execution.This issue affects upKeeper Instant Privilege Access: through 1.5.0.
CVE-2024-46943	Opendaylight Authentication, Authorization and Accounting (AAA)		0.00	—	0.01	Sep 15, 2024	An issue was discovered in OpenDaylight Authentication, Authorization and Accounting (AAA) through 0.19.3. A rogue controller can join a cluster to impersonate an offline peer, even if this rogue controller does not possess the complete cluster configuration information.

CVE-2019-25608HigMar 22, 2026
Entersrl
Iperius Backup
risk 0.55cvss 8.4epss 0.00
Iperius Backup 6.1.0 contains a privilege escalation vulnerability that allows low-privilege users to execute arbitrary programs with elevated privileges by creating backup jobs. Attackers can configure backup jobs to execute malicious batch files or programs before or after…
CVE-2026-2450HigApr 14, 2026
risk 0.48cvss —epss 0.00
.NET misconfiguration: use of impersonation vulnerability in upKeeper Solutions upKeeper Instant Privilege Access allows Hijacking a Privileged Thread of Execution.This issue affects upKeeper Instant Privilege Access: through 1.5.0.
CVE-2024-46943Sep 15, 2024
Opendaylight
Authentication, Authorization and Accounting (AAA)
risk 0.00cvss —epss 0.01
An issue was discovered in OpenDaylight Authentication, Authorization and Accounting (AAA) through 0.19.3. A rogue controller can join a cluster to impersonate an offline peer, even if this rogue controller does not possess the complete cluster configuration information.