Aug 2021: ASP.NET Core and Visual Studio Information Disclosure Vulnerability
CVE-2021-34532 Published on August 12, 2021

ASP.NET Core and Visual Studio Information Disclosure Vulnerability
ASP.NET Core and Visual Studio Information Disclosure Vulnerability

Github Repository Vendor Advisory NVD

Vulnerability Analysis

Exploitation:
NONE
Automatable:
NO
Technical Impact:
PARTIAL

Products Associated with CVE-2021-34532

stack.watch emails you whenever new vulnerabilities are published in Microsoft ASP.NET Core or Microsoft Visual Studio 2019. Just hit a watch button to start following.

Microsoft ASP.NET Core
Microsoft Visual Studio 2019

Affected Versions

Microsoft ASP.NET Core 2.1: Microsoft ASP.NET Core 3.1: Microsoft ASP.NET Core 5.0: Microsoft Visual Studio 2019 version 16.10 (includes 16.0 - 16.9): Microsoft Visual Studio 2019 version 16.4 (includes 16.0 - 16.3): Microsoft Visual Studio 2019 version 16.7 (includes 16.0 – 16.6): Microsoft Visual Studio 2019 version 16.9 (includes 16.0 - 16.8): Microsoft Visual Studio 2019 for Mac version 8.10:

Vulnerable Packages

The following package name and versions may be associated with CVE-2021-34532

Package Manager Vulnerable Package Versions Fixed In
nuget Microsoft.AspNetCore.Authentication.JwtBearer < 2.1.29 2.1.29
nuget Microsoft.AspNetCore.Authentication.JwtBearer >= 3.0.0, < 3.1.18 3.1.18
nuget Microsoft.AspNetCore.Authentication.JwtBearer >= 5.0.0, < 5.0.9 5.0.9

Exploit Probability

EPSS
1.22%
Percentile
69.04%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.