CVE-2021-24112CWE-94code-injection

CVE-2021-24112

High · published February 26, 2021

CVSS v3.1
8.1
EPSS
3%
Percentile
89.0
In the wild
Unconfirmed
What it is

.NET Core Remote Code Execution Vulnerability

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.03454 · 89.0th percentile
Weakness
CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2021-02-26T04:15Z
Affected products (5)
ProductVersionsFixed in
microsoft/.net≥ 5.0, ≤ 5.0.2—
microsoft/.net_core≥ 2.1, ≤ 2.1.24—
microsoft/.net_core≥ 3.1, ≤ 3.1.11—
microsoft/mono≥ 6.12.0, < 6.12.0.1226.12.0.122
microsoft/visual_studio_2019all versions—
References (2)
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-24112 · [email protected]https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-24112 · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 25 FEB 23:01Z
    .NET Core Remote Code Execution Vulnerability
    cvelistv5