May 2020: ASP.NET Core Denial of Service Vulnerability
CVE-2020-1161 Published on May 21, 2020

ASP.NET Core Denial of Service Vulnerability
A denial of service vulnerability exists when ASP.NET Core improperly handles web requests. An attacker who successfully exploited this vulnerability could cause a denial of service against an ASP.NET Core web application. The vulnerability can be exploited remotely, without authentication. A remote unauthenticated attacker could exploit this vulnerability by issuing specially crafted requests to the ASP.NET Core application. The update addresses the vulnerability by correcting how the ASP.NET Core web application handles web requests.

Vendor Advisory NVD


Products Associated with CVE-2020-1161

Want to know whenever a new CVE is published for Microsoft products? stack.watch will email you.

Microsoft ASP.NET Core
 
Microsoft Visual Studio 2017
 
Microsoft Visual Studio 2019
 

Affected Versions

Microsoft ASP.NET Core 3.1: Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8): Microsoft Visual Studio 2019 version 16.0: Microsoft Visual Studio 2019 version 16.4 (includes 16.0 - 16.3): Microsoft Visual Studio 2019 version 16.5:

Exploit Probability

EPSS
5.14%
Percentile
91.86%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.