CVE-2020-1476 ASP.NET and .NET Elevation of Privilege Vulnerability

What is CVE-2020-1476?

CVE-2020-1476 is a medium-severity missing authorization vulnerability in Microsoft .Net Framework, published on 17 Aug 2020. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

An elevation of privilege vulnerability exists when ASP.NET or .NET web applications running on IIS improperly allow access to cached files. An attacker who successfully exploited this vulnerability could gain access to restricted files. To exploit this vulnerability, an attacker would need to send a specially crafted request to an affected server. The update addresses the vulnerability by changing how ASP.NET and .NET handle requests.

Which versions are affected by CVE-2020-1476?

It affects 1 product.

Products include Microsoft .Net Framework.

How do I fix CVE-2020-1476?

No fix has been published for CVE-2020-1476 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2020-1476 being exploited?

There is no known exploitation of CVE-2020-1476 in the wild and no public exploit code.

Other vulnerabilities in Microsoft .Net Framework

• CVE-2020-0646 Microsoft .NET Framework Remote Code Execution Exploited Critical 9.8
• CVE-2017-8759 Microsoft .NET Framework Remote Code Execution Exploited High 7.8
• CVE-2015-1671 Microsoft Windows Remote Code Execution Exploited High 7.8
• CVE-2024-29059 Microsoft .NET Framework Information Disclosure Exploited High 7.5
• CVE-2014-4073 Privilege escalation in n/a Critical 10.0

All Microsoft .Net Framework vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-8m4h-93rx-x9x3.