Log in Start free

Vulnerability · Published Oct 30, 2024 · Assigned by GitHub_M

CVE-2024-50353ICG.AspNetCore.Utilities.CloudStorage's Secure Token Durations Different Than Expected

Medium 5.3

In plain English

A medium-severity improper access control in aspnetcore.utilities.cloudstorage from IowaComputerGurus. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 23% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.3%top 77.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

ICG.AspNetCore.Utilities.CloudStorage is a collection of cloud storage utilities to assist with the management of files for cloud upload. Users of this library that set a duration for a SAS Uri with a value other than 1 hour may have generated a URL with a duration that is longer, or shorter than desired. Users not implemented SAS Uri's are unaffected. This issue was resolved in version 8.0.0 of the library.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
NuGeticg.aspnetcore.utilities.cloudstorage8.0.0GHSA-24mc-gc52-47jv

Affected products (as reported)

VendorProductVersions
IowaComputerGurus aspnetcore.utilities.cloudstorage < 8.0.0

Weakness: CWE-284 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References