ASP.NET and .NET Elevation of Privilege Vulnerability
Priority LOW 27Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA.
Summary
An elevation of privilege vulnerability exists when ASP.NET or .NET web applications running on IIS improperly allow access to cached files. An attacker who successfully exploited this vulnerability could gain access to restricted files. To exploit this vulnerability, an attacker would need to send a specially crafted request to an affected server. The update addresses the vulnerability by changing how ASP.NET and .NET handle requests.
Why it matters now
EPSS 0.01129 66th percentileScored 2026-11-07
Fix Fixed Microsoft .NET Framework 4.8 (Microsoft): publicationMicrosoft .NET Framework 3.5 AND 4.8 (Microsoft): publication+10 more products
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Microsoft | Microsoft .NET Framework 4.8 | 4.8.0 to before publication | publication | Patch available | CNA |
| Microsoft | Microsoft .NET Framework 3.5 AND 4.8 | 4.8.0 to before publication | publication | Patch available | CNA |
| Microsoft | Microsoft .NET Framework 2.0 Service Pack 2 | 2.0.0 to before publication | publication | Patch available | CNA |
| Microsoft | Microsoft .NET Framework 4.5.2 | 4.0.0.0 to before publication | publication | Patch available | CNA |
| Microsoft | Microsoft .NET Framework 4.6/4.6.1/4.6.2/4.7/4.7.1/4.7.2 | 4.0.0.0 to before publication | publication | Patch available | CNA |
| Microsoft | Microsoft .NET Framework 3.5 AND 4.7.2 | 4.7.0 to before publication | publication | Patch available | CNA |
| Microsoft | Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 | 3.0.0.0 to before publication | publication | Patch available | CNA |
| Microsoft | Microsoft .NET Framework 3.5 AND 4.6/4.6.1/4.6.2 | 3.5.0 to before publication | publication | Patch available | CNA |
| Microsoft | Microsoft .NET Framework 3.5 AND 4.7.1/4.7.2 | 3.0 to before publication | publication | Patch available | CNA |
| Microsoft | Microsoft .NET Framework 4.6 | 4.0.0.0 to before publication | publication | Patch available | CNA |
| Microsoft | Microsoft .NET Framework 3.5 | 3.5.0 to before publication | publication | Patch available | CNA |
| Microsoft | Microsoft .NET Framework 3.5.1 | 3.5.0 to before publication | publication | Patch available | CNA |
- Microsoft .NET Framework 4.8 VendorMicrosoft Affected 4.8.0 to before publication Fixed in publication Patch available CNA
- Microsoft .NET Framework 3.5 AND 4.8 VendorMicrosoft Affected 4.8.0 to before publication Fixed in publication Patch available CNA
- Microsoft .NET Framework 2.0 Service Pack 2 VendorMicrosoft Affected 2.0.0 to before publication Fixed in publication Patch available CNA
- Microsoft .NET Framework 4.5.2 VendorMicrosoft Affected 4.0.0.0 to before publication Fixed in publication Patch available CNA
- Microsoft .NET Framework 4.6/4.6.1/4.6.2/4.7/4.7.1/4.7.2 VendorMicrosoft Affected 4.0.0.0 to before publication Fixed in publication Patch available CNA
- Microsoft .NET Framework 3.5 AND 4.7.2 VendorMicrosoft Affected 4.7.0 to before publication Fixed in publication Patch available CNA
- Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 VendorMicrosoft Affected 3.0.0.0 to before publication Fixed in publication Patch available CNA
- Microsoft .NET Framework 3.5 AND 4.6/4.6.1/4.6.2 VendorMicrosoft Affected 3.5.0 to before publication Fixed in publication Patch available CNA
- Microsoft .NET Framework 3.5 AND 4.7.1/4.7.2 VendorMicrosoft Affected 3.0 to before publication Fixed in publication Patch available CNA
- Microsoft .NET Framework 4.6 VendorMicrosoft Affected 4.0.0.0 to before publication Fixed in publication Patch available CNA
- Microsoft .NET Framework 3.5 VendorMicrosoft Affected 3.5.0 to before publication Fixed in publication Patch available CNA
- Microsoft .NET Framework 3.5.1 VendorMicrosoft Affected 3.5.0 to before publication Fixed in publication Patch available CNA
CPE configurations NVD · 30
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:microsoft:.net_framework:2.0:sp2:*:*:*:*:*:* | 2.0 sp2 | Vulnerable | Microsoft |
| cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:a:microsoft:.net_framework:3.5:*:*:*:*:*:*:* | 3.5 | Vulnerable | Microsoft |
| cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:* | r2 | Running on | Microsoft |
| cpe:2.3:a:microsoft:.net_framework:4.6.2:*:*:*:*:*:*:* | 4.6.2 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:.net_framework:4.7:*:*:*:*:*:*:* | 4.7 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:.net_framework:4.7.1:*:*:*:*:*:*:* | 4.7.1 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:.net_framework:4.7.2:*:*:*:*:*:*:* | 4.7.2 | Vulnerable | Microsoft |
- cpe:2.3:a:microsoft:.net_framework:2.0:sp2:*:*:*:*:*:* Versions 2.0 sp2 Vulnerable ·Microsoft
- cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:a:microsoft:.net_framework:3.5:*:*:*:*:*:*:* Versions 3.5 Vulnerable ·Microsoft
- cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:* Versions r2 Running on ·Microsoft
- cpe:2.3:a:microsoft:.net_framework:4.6.2:*:*:*:*:*:*:* Versions 4.6.2 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:.net_framework:4.7:*:*:*:*:*:*:* Versions 4.7 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:.net_framework:4.7.1:*:*:*:*:*:*:* Versions 4.7.1 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:.net_framework:4.7.2:*:*:*:*:*:*:* Versions 4.7.2 Vulnerable ·Microsoft
Show 20 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:* | 1607 | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:a:microsoft:.net_framework:4.6:*:*:*:*:*:*:* | 4.6 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:.net_framework:4.6.1:*:*:*:*:*:*:* | 4.6.1 | Vulnerable | Microsoft |
| cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_10:1709:*:*:*:*:*:*:* | 1709 | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_10:1803:*:*:*:*:*:*:* | 1803 | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_10:1809:*:*:*:*:*:*:* | 1809 | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:a:microsoft:.net_framework:4.8:*:*:*:*:*:*:* | 4.8 | Vulnerable | Microsoft |
| cpe:2.3:o:microsoft:windows_10:1903:*:*:*:*:*:*:* | 1903 | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_10:1909:*:*:*:*:*:*:* | 1909 | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_10:2004:*:*:*:*:*:*:* | 2004 | Running on | Microsoft |
| cpe:2.3:a:microsoft:.net_framework:3.5.1:*:*:*:*:*:*:* | 3.5.1 | Vulnerable | Microsoft |
| cpe:2.3:o:microsoft:windows_7:sp1:*:*:*:*:*:*:* | sp1 | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_server_2008:r2:*:*:*:*:*:*:* | r2 | Running on | Microsoft |
| cpe:2.3:a:microsoft:.net_framework:4.5.2:*:*:*:*:*:*:* | 4.5.2 | Vulnerable | Microsoft |
| cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:* | r2 sp1 | Running on | Microsoft |
- cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:* Versions 1607 Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:a:microsoft:.net_framework:4.6:*:*:*:*:*:*:* Versions 4.6 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:.net_framework:4.6.1:*:*:*:*:*:*:* Versions 4.6.1 Vulnerable ·Microsoft
- cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_10:1709:*:*:*:*:*:*:* Versions 1709 Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_10:1803:*:*:*:*:*:*:* Versions 1803 Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_10:1809:*:*:*:*:*:*:* Versions 1809 Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:a:microsoft:.net_framework:4.8:*:*:*:*:*:*:* Versions 4.8 Vulnerable ·Microsoft
- cpe:2.3:o:microsoft:windows_10:1903:*:*:*:*:*:*:* Versions 1903 Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_10:1909:*:*:*:*:*:*:* Versions 1909 Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_10:2004:*:*:*:*:*:*:* Versions 2004 Running on ·Microsoft
- cpe:2.3:a:microsoft:.net_framework:3.5.1:*:*:*:*:*:*:* Versions 3.5.1 Vulnerable ·Microsoft
- cpe:2.3:o:microsoft:windows_7:sp1:*:*:*:*:*:*:* Versions sp1 Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_server_2008:r2:*:*:*:*:*:*:* Versions r2 Running on ·Microsoft
- cpe:2.3:a:microsoft:.net_framework:4.5.2:*:*:*:*:*:*:* Versions 4.5.2 Vulnerable ·Microsoft
- cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:* Versions r2 sp1 Running on ·Microsoft
Remediation
- Fix · CNA Microsoft .NET Framework 4.8 (Microsoft) Fixed in publication
- Fix · CNA Microsoft .NET Framework 3.5 AND 4.8 (Microsoft) Fixed in publication
- Fix · CNA Microsoft .NET Framework 2.0 Service Pack 2 (Microsoft) Fixed in publication
- Fix · CNA Microsoft .NET Framework 4.5.2 (Microsoft) Fixed in publication
- Fix · CNA Microsoft .NET Framework 4.6/4.6.1/4.6.2/4.7/4.7.1/4.7.2 (Microsoft) Fixed in publication
- Fix · CNA Microsoft .NET Framework 3.5 AND 4.7.2 (Microsoft) Fixed in publication
- Fix · CNA Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 (Microsoft) Fixed in publication
- Fix · CNA Microsoft .NET Framework 3.5 AND 4.6/4.6.1/4.6.2 (Microsoft) Fixed in publication
- Fix · CNA Microsoft .NET Framework 3.5 AND 4.7.1/4.7.2 (Microsoft) Fixed in publication
- Fix · CNA Microsoft .NET Framework 4.6 (Microsoft) Fixed in publication
- Fix · CNA Microsoft .NET Framework 3.5 (Microsoft) Fixed in publication
- Fix · CNA Microsoft .NET Framework 3.5.1 (Microsoft) Fixed in publication
Timeline
- 2026-10-02 Threatist record created from CVE-2020-1476
- 2026-10-03 Alias added: GHSA-8m4h-93rx-x9x3
More Microsoft .net Framework vulnerabilities
- TI-2020-00622 XML injection in Microsoft .NET Framework 4.6/4.6.1/4.6.2/4.7/4.7.1/4.7.2 KEVCVSS 3.1CRITICAL 9.8
- TI-2020-01112 A remote code execution vulnerability exists in .NET Framework, Microsoft SharePoint, and… KEVCVSS 3.1HIGH 7.8
- TI-2017-06273 Code injection in Microsoft .NET Framework KEVCVSS 3.1HIGH 7.8
- TI-2015-01495 The Windows DirectWrite library, as used in Microsoft .NET Framework 3.0 SP2, 3.5, 3.5.1… KEVCVSS 3.1HIGH 7.8
- TI-2024-19239 .NET Framework Information Disclosure Vulnerability KEVCVSS 3.1HIGH 7.5
- TI-2023-18684 ASP.NET Elevation of Privilege Vulnerability CVSS 3.1HIGH 8.8
Sources
- CVE-2020-1476 · CVE Program
- CVE-2020-1476 · NVD
- FIRST EPSS
- GHSA-8m4h-93rx-x9x3 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences