What is CVE-2020-1108?

CVE-2020-1108 is a high-severity vulnerability in Microsoft .Net Framework 2.0. CVSS score: 7.5/10. Published 2020-05-21.

How severe is CVE-2020-1108?

High severity. CVSS v3 base score is 7.5 out of 10.

Is CVE-2020-1108 known to be exploited?

2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Vulnerability in Microsoft .Net Framework 2.0

CVE-2020-1108

A denial of service vulnerability exists when .NET Core or .NET Framework improperly handles web requests, aka '.NET Core & .NET Framework Denial of Service Vulnerability'.

EPSS: 0.117 (95.6th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.

Affected products

Microsoft .Net Framework 2.0 — versions Service Pack 2 on Windows Server 2008 for 32-bit Systems Service Pack 2, Service Pack 2 on Windows Server 2008 for x64-based Systems Service Pack 2
Microsoft .Net Framework 3.0 — versions Service Pack 2 on Windows Server 2008 for 32-bit Systems Service Pack 2, Service Pack 2 on Windows Server 2008 for x64-based Systems Service Pack 2
Microsoft .Net Framework 3.5 — versions Windows 8.1 for 32-bit systems, Windows 8.1 for x64-based systems, Windows Server 2012
Microsoft .Net Framework 3.5.1 — versions Windows 7 for 32-bit Systems Service Pack 1, Windows 7 for x64-based Systems Service Pack 1, Windows Server 2008 R2 for x64-based Systems Service Pack 1
Microsoft .Net Framework 3.5 And 4.6.2/4.7/4.7.1/4.7.2 On Windows 10 Version 1607 For 32-bit Systems — versions unspecified
Microsoft .Net Framework 3.5 And 4.6.2/4.7/4.7.1/4.7.2 On Windows 10 Version 1607 For X64-based Systems — versions unspecified
Microsoft .Net Framework 3.5 And 4.6.2/4.7/4.7.1/4.7.2 On Windows Server 2016 — versions unspecified
Microsoft .Net Framework 3.5 And 4.6.2/4.7/4.7.1/4.7.2 On Windows Server 2016 (Server Core Installation) — versions unspecified
Microsoft .Net Framework 3.5 And 4.6/4.6.1/4.6.2 On Windows 10 For 32-bit Systems — versions unspecified
Microsoft .Net Framework 3.5 And 4.6/4.6.1/4.6.2 On Windows 10 For X64-based Systems — versions unspecified

Public proof-of-concept exploits

References

secure@microsoft.com (Patch, x_refsource_MISC, Vendor Advisory)

Frequently asked questions

What is CVE-2020-1108?: CVE-2020-1108 is a high-severity vulnerability in Microsoft .Net Framework 2.0. CVSS score: 7.5/10. Published 2020-05-21.
How severe is CVE-2020-1108?: High severity. CVSS v3 base score is 7.5 out of 10.
Is CVE-2020-1108 known to be exploited?: 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.