Actively exploited · Published Mar 22, 2024 · Assigned by microsoft
CVE-2024-29059.NET Framework Information Disclosure Vulnerability
High 7.5 Exploited
In plain English
A high-severity security flaw in Microsoft .NET Framework 2.0 Service Pack 2 from Microsoft. Attackers are actively exploiting it in the wild (listed by CISA on February 4, 2025). The chance it is exploited in the next 30 days is estimated at 98.6% (higher than 99.9% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei, public proof-of-concept code. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CISA guidance
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Federal agencies must remediate by Feb 25, 2025.
Official description
.NET Framework Information Disclosure Vulnerability
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Microsoft | Microsoft .NET Framework 4.8 | 4.8.0 – before 4.8.04690.02 |
| Microsoft | Microsoft .NET Framework 3.5 AND 4.8 | 4.8.0 – before 4.8.04690.02 |
| Microsoft | Microsoft .NET Framework 3.5 AND 4.7.2 | 4.7.0 – before 4.7.04081.03 |
| Microsoft | Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 | 4.7.0 – before 4.7.04081.03 |
| Microsoft | Microsoft .NET Framework 3.5 AND 4.8.1 | 4.8.1 – before 4.8.09214.01 |
| Microsoft | Microsoft .NET Framework 4.6.2 | 4.7.0 – before 4.7.04081.03 |
| Microsoft | Microsoft .NET Framework 3.5 AND 4.6/4.6.2 | 10.0.0 – before 10.0.10240.20402 |
| Microsoft | Microsoft .NET Framework 2.0 Service Pack 2 | 2.0.0 – before 3.0.50727.8976 |
| Microsoft | Microsoft .NET Framework 3.0 Service Pack 2 | 3.0.0 – before 3.0.50727.8976 |
| Microsoft | Microsoft .NET Framework 3.5 | 3.5.0 – before 3.0.50727.8976 |
| Microsoft | Microsoft .NET Framework 3.5.1 | 3.5.0 – before 3.0.30729.8959 |
Weakness: CWE-209 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
References
- .NET Framework Information Disclosure Vulnerability vendor-advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-29059 government-resource