CVE-2025-24070
Severity CVSS v4.0:
Pending analysis
Type:
Unavailable / Other
Publication date:
11/03/2025
Last modified:
02/07/2025
Description
Weak authentication in ASP.NET Core & Visual Studio allows an unauthorized attacker to elevate privileges over a network.
Impact
Base Score 3.x
7.00
Severity 3.x
HIGH
Vulnerable products and versions
CPE | From | Up to |
---|---|---|
cpe:2.3:a:microsoft:asp.net_core:*:*:*:*:*:*:*:* | 8.0.0 (including) | 8.0.14 (excluding) |
cpe:2.3:a:microsoft:asp.net_core:*:*:*:*:*:*:*:* | 9.0.0 (including) | 9.0.3 (excluding) |
cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:* | 17.8.0 (including) | 17.8.19 (excluding) |
cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:* | 17.10.0 (including) | 17.10.12 (excluding) |
cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:* | 17.12.0 (including) | 17.12.6 (excluding) |
cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:* | 17.13.0 (including) | 17.13.3 (excluding) |
To consult the complete list of CPE names with products and versions, see this page