CVE-2020-1108
Last modified
CVE-2020-1108 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. A denial of service vulnerability exists when .NET Core or .NET Framework improperly handles web requests. An attacker who successfully exploited this vulnerability could cause a denial of service against a .NET Core or .NET Framework web application. EPSS estimates a 11.68% chance of exploitation in the next 30 days.
Description
A denial of service vulnerability exists when .NET Core or .NET Framework improperly handles web requests. An attacker who successfully exploited this vulnerability could cause a denial of service against a .NET Core or .NET Framework web application. The vulnerability can be exploited remotely, without authentication. A remote unauthenticated attacker could exploit this vulnerability by issuing specially crafted requests to the .NET Core or .NET Framework application. The update addresses the vulnerability by correcting how the .NET Core or .NET Framework web application handles web requests.
Metrics
Affected Software
| Vendor | Product | Versions | Update |
|---|---|---|---|
| Microsoft | .Net | 5.0 | Preview1 |
| Microsoft | .Net Core | >= 2.1, <= 2.1.18 | — |
| Microsoft | .Net Core | >= 3.0, <= 3.1.4 | — |
| Microsoft | .Net Framework | 2.0 | Sp2 |
| Microsoft | .Net Framework | 3.0 | Sp2 |
| Microsoft | .Net Framework | 4.6 | — |
| Microsoft | .Net Framework | 3.5 | — |
| Microsoft | .Net Framework | 4.5.2 | — |
| Microsoft | .Net Framework | 4.6.1 | — |
| Microsoft | .Net Framework | 4.6.2 | — |
| Microsoft | .Net Framework | 4.7 | — |
| Microsoft | .Net Framework | 4.7.1 | — |
| Microsoft | .Net Framework | 4.7.2 | — |
| Microsoft | .Net Framework | 4.8 | — |
| Microsoft | .Net Framework | 3.5.1 | — |
| Microsoft | .Net Core | 2.1 | — |
| Microsoft | .Net Core | 3.1 | — |
| Microsoft | Visual Studio 2017 | 15.9 | — |
| Microsoft | Visual Studio 2019 | 16.0 | — |
| Microsoft | Visual Studio 2019 | 16.4 | — |
| Microsoft | Visual Studio 2019 | 16.5 | — |
| Microsoft | Powershell | 7.0 | — |
| Microsoft | Powershell Core | 6.2 | — |
References
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2020-1108?
How severe is CVE-2020-1108?
How do I fix CVE-2020-1108?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2020
- CVE-2020-11074In PrestaShop from version 1.5.3.0 and before version 1.7.6.…5.4
- CVE-2020-11075In Anchore Engine version 0.7.0, a specially crafted contain…9.9
- CVE-2020-11076In Puma (RubyGem) before 4.3.4 and 3.12.5, an attacker could…7.5
- CVE-2020-11077In Puma (RubyGem) before 4.3.5 and 3.12.6, a client could sm…7.5
- CVE-2020-11078In httplib2 before version 0.18.0, an attacker controlling u…6.8
- CVE-2020-11079node-dns-sync (npm module dns-sync) through 0.2.0 allows exe…9.8
- CVE-2020-11080In nghttp2 before version 1.41.0, the overly large HTTP/2 SE…7.5
- CVE-2020-11081osquery before version 4.4.0 enables a privilege escalation …8.2
- CVE-2020-11082In Kaminari before 1.2.1, there is a vulnerability that woul…6.1
- CVE-2020-11083In October from version 1.0.319 and before version 1.0.466, …4.8
- CVE-2020-11084In iPear, the manual execution of the eval() function can le…5.4
- CVE-2020-11085In FreeRDP before 2.1.0, there is an out-of-bounds read in c…3.5
Are you affected by CVE-2020-1108?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST