Weak Authentication Vulnerability in ASP.NET Core and Visual Studio
CVE-2025-24070

7HIGH

Key Information:

Vendor
Microsoft
Status
Asp.net Core 8.0
Asp.net Core 9.0
Microsoft Visual Studio 2022 Version 17.12
Microsoft Visual Studio 2022 Version 17.13
Vendor
CVE Published:
11 March 2025

Summary

A security flaw in ASP.NET Core and Visual Studio can potentially allow unauthorized attackers to escalate their privileges over a network. This vulnerability arises from inadequate authentication mechanisms, which can be exploited by malicious entities to gain elevated access to sensitive functions and data within affected systems. It is crucial for users to apply security updates promptly to mitigate the risks associated with this vulnerability.

Affected Version(s)

ASP.NET Core 8.0 Unknown 1.0.0 < 8.0.14

ASP.NET Core 9.0 Unknown 1.0.0 < 9.0.3

Microsoft Visual Studio 2022 version 17.10 Unknown 17.10 < 17.10.12

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE...
vendor-advisory

CVSS V3.1

Score:
7
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.