{"id":"CVE-2020-1045","details":"\u003cp\u003eA security feature bypass vulnerability exists in the way Microsoft ASP.NET Core parses encoded cookie names.\u003c/p\u003e\n\u003cp\u003eThe ASP.NET Core cookie parser decodes entire cookie strings which could allow a malicious attacker to set a second cookie with the name being percent encoded.\u003c/p\u003e\n\u003cp\u003eThe security update addresses the vulnerability by fixing the way the ASP.NET Core cookie parser handles encoded names.\u003c/p\u003e","aliases":["BIT-aspnet-core-2020-1045","GHSA-hxrm-9w7p-39cc"],"modified":"2026-04-10T04:18:31.065085Z","published":"2020-09-11T17:15:18.307Z","references":[{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5LN2FUVBSVPGK7AU3NMLO3YR6CGONQPB/"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ASICXQXS4M7MTAF6SGQMCLCA63DLCUT3/"},{"type":"ADVISORY","url":"https://security.snyk.io/vuln/SNYK-RHEL8-DOTNET-1439600"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2020:3699"},{"type":"ADVISORY","url":"https://github.com/dotnet/core/blob/main/release-notes/3.1/3.1.8/3.1.8.md#changes-in-318"},{"type":"FIX","url":"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1045"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/dotnet/aspnetcore","events":[{"introduced":"00e08d8c11f4e9649492342c9c613a758efd2e4d"},{"last_affected":"adc6f4d362456fd5a4d6f35e66a10bb8b1660470"},{"introduced":"03019875e4eab279a99ba3ba5ee75fb0e4935ce6"},{"fixed":"c75b3f7a2fb9fe21fd96c93c070fdfa88a2fbe97"},{"introduced":"0"},{"last_affected":"3f1acb59718cadf111a0a796681e3d3509bb3381"}],"database_specific":{"versions":[{"introduced":"2.1"},{"last_affected":"2.1.21"},{"introduced":"3.1"},{"fixed":"3.1.8"},{"introduced":"0"},{"last_affected":"8.0"}]}}],"versions":["1.0.0","1.0.0-rc2","1.0.0-rc2-final","1.0.1","1.0.3","1.0.4","1.0.5","1.0.7","1.1.0","1.1.0-preview1","1.1.1","1.1.2","1.1.3","1.1.5","2.0.0","2.0.0-preview1","2.0.0-preview2","2.1.0","2.1.0-preview1","2.1.0-preview2","2.1.1","2.1.3","2.1.5","2.1.6","v1.0.0-alpha2","v1.0.0-alpha3","v1.0.0-beta4","v1.0.0-beta5","v1.0.0-beta6","v1.0.0-beta7","v1.0.0-beta8","v1.0.0-rc1-final","v1.0.0-rc1-update1","v2.1.10","v2.1.11","v2.1.12","v2.1.13","v2.1.14","v2.1.16","v2.1.17","v2.1.18","v2.1.19","v2.1.20","v2.1.21","v2.1.7","v2.1.8","v2.1.9","v3.0.0-preview-18579-0056","v3.0.0-preview-19075-0444","v3.1.0","v3.1.0-preview3.19555.2","v3.1.2","v3.1.3","v8.0.0"],"database_specific":{"unresolved_ranges":[{"events":[{"introduced":"0"},{"last_affected":"32"}]},{"events":[{"introduced":"0"},{"last_affected":"33"}]},{"events":[{"introduced":"0"},{"last_affected":"8.2"}]},{"events":[{"introduced":"0"},{"last_affected":"8.4"}]},{"events":[{"introduced":"0"},{"last_affected":"8.6"}]},{"events":[{"introduced":"0"},{"last_affected":"8.2"}]},{"events":[{"introduced":"0"},{"last_affected":"8.4"}]},{"events":[{"introduced":"0"},{"last_affected":"8.6"}]},{"events":[{"introduced":"0"},{"last_affected":"8.2"}]},{"events":[{"introduced":"0"},{"last_affected":"8.4"}]},{"events":[{"introduced":"0"},{"last_affected":"8.6"}]}],"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-1045.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"}]}