CVE-2020-0603
Remote code execution in ASP.NET Core
A remote code execution vulnerability exists in ASP.NET Core software when the software fails to handle objects in memory.An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user, aka 'ASP.NET Core Remote Code Execution Vulnerability'.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
A remote code execution vulnerability exists in ASP.NET Core software when the software fails to handle objects in memory.An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user, aka 'ASP.NET Core Remote Code Execution Vulnerability'.
- Record
CVE-2020-0603- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 2.0
- 9.3 High
AV:N/AC:M/Au:N/C:C/I:C/A:C - Weakness
- CWE-787
- Updated
- 2026-11-02
CVE List No score
A remote code execution vulnerability exists in ASP.NET Core software when the software fails to handle objects in memory.An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user, aka 'ASP.NET Core Remote Code Execution Vulnerability'.
- Record
CVE-2020-0603- Updated
- 2026-11-02
EUVDEUVD-2022-2713 No score
A remote code execution vulnerability exists in ASP.NET Core software when the software fails to handle objects in memory.An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user, aka 'ASP.NET Core Remote Code Execution Vulnerability'.
- Record
EUVD-2022-2713- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-655q-9gvg-q4cm No score
Remote code execution in ASP.NET Core
A remote code execution vulnerability exists in ASP.NET Core software when the software fails to handle objects in memory.An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user, aka 'ASP.NET Core Remote Code Execution Vulnerability'.
- Record
GHSA-655q-9gvg-q4cm- Weakness
- CWE-119
- Updated
- 2026-11-02
OSV
A remote code execution vulnerability exists in ASP.NET Core software when the software fails to handle objects in memory.An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user, aka 'ASP.NET Core Remote Code Execution Vulnerability'.
- Record
CVE-2020-0603- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2020:0130
Red Hat Security Advisory: .NET Core on Red Hat Enterprise Linux security and bug fix update
- Record
RHSA-2020:0130- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2020:0134
Red Hat Security Advisory: .NET Core on Red Hat Enterprise Linux security and bug fix update
- Record
RHSA-2020:0134- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVBIT-aspnet-core-2020-0603 No score
A remote code execution vulnerability exists in ASP.NET Core software when the software fails to handle objects in memory.An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user, aka 'ASP.NET Core Remote Code Execution Vulnerability'.
- Record
BIT-aspnet-core-2020-0603- Updated
- 2026-11-02
OSVGHSA-655q-9gvg-q4cm No score
Remote code execution in ASP.NET Core
A remote code execution vulnerability exists in ASP.NET Core software when the software fails to handle objects in memory.An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user, aka 'ASP.NET Core Remote Code Execution Vulnerability'.
- Record
GHSA-655q-9gvg-q4cm- Weakness
- CWE-119
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
Microsoft.AspNetCore.AllNuGet |
2.1.0 up to 2.1.15 | 2.1.15 |
Microsoft.AspNetCore.AppNuGet |
3.1.0 to 3.1.0 | 3.1.1 |
Microsoft.AspNetCore.AppNuGet |
3.0.0 to 3.0.0 | 3.0.1 |
Microsoft.AspNetCore.AppNuGet |
2.1.0 up to 2.1.15 | 2.1.15 |
Microsoft.AspNetCore.Http.ConnectionsNuGet |
1.0.0 up to 1.0.15 | 1.0.15 |
Microsoft.AspNetCore.App.Runtime.linux-armNuGet |
3.1.0 up to 3.1.1 | 3.1.1 |
Microsoft.AspNetCore.App.Runtime.linux-arm64NuGet |
3.1.0 up to 3.1.1 | 3.1.1 |
Microsoft.AspNetCore.App.Runtime.linux-musl-arm64NuGet |
3.1.0 up to 3.1.1 | 3.1.1 |
Microsoft.AspNetCore.App.Runtime.linux-musl-x64NuGet |
3.1.0 up to 3.1.1 | 3.1.1 |
Microsoft.AspNetCore.App.Runtime.linux-x64NuGet |
3.1.0 up to 3.1.1 | 3.1.1 |
Show 53 moreShow less
| Package | Affected | Fixed |
|---|---|---|
Microsoft.AspNetCore.App.Runtime.osx-x64NuGet |
3.1.0 up to 3.1.1 | 3.1.1 |
Microsoft.AspNetCore.App.Runtime.win-armNuGet |
3.1.0 up to 3.1.1 | 3.1.1 |
Microsoft.AspNetCore.App.Runtime.win-x64NuGet |
3.1.0 up to 3.1.1 | 3.1.1 |
Microsoft.AspNetCore.App.Runtime.win-x86NuGet |
3.1.0 up to 3.1.1 | 3.1.1 |
aspnet-coreBitnami |
2.1.0 up to 2.1.1, 3.0.0 up to 3.0.1, 3.1.0 up to 3.1.1 | 2.1.13.0.13.1.1 |
Microsoft.AspNetCore.AllNuGet |
2.1.0 up to 2.1.15, plus listed versions 2.1.12.1.102.1.112.1.122.1.13 Show 9 moreShow less2.1.142.1.22.1.32.1.42.1.52.1.62.1.72.1.82.1.9 |
2.1.15 |
Microsoft.AspNetCore.AppNuGet |
3.1.0 up to 3.1.1 | 3.1.1 |
Microsoft.AspNetCore.AppNuGet |
3.0.0 up to 3.0.1 | 3.0.1 |
Microsoft.AspNetCore.AppNuGet |
2.1.0 up to 2.1.15, plus listed versions 2.1.12.1.102.1.112.1.122.1.13 Show 9 moreShow less2.1.142.1.22.1.32.1.42.1.52.1.62.1.72.1.82.1.9 |
2.1.15 |
Microsoft.AspNetCore.Http.ConnectionsNuGet |
1.0.0 up to 1.0.15, plus listed versions 1.0.11.0.21.0.31.0.4 |
1.0.15 |
aspnetcore-runtime-3.0Red Hat:enterprise_linux:8::appstream From an advisory covering 2 CVEs |
before 0:3.0.2-2.el8_1 | 0:3.0.2-2.el8_1 |
aspnetcore-targeting-pack-3.0Red Hat:enterprise_linux:8::appstream From an advisory covering 2 CVEs |
before 0:3.0.2-2.el8_1 | 0:3.0.2-2.el8_1 |
dotnetRed Hat:enterprise_linux:8::appstream From an advisory covering 2 CVEs |
before 0:3.0.102-2.el8_1 | 0:3.0.102-2.el8_1 |
dotnet-apphost-pack-3.0Red Hat:enterprise_linux:8::appstream From an advisory covering 2 CVEs |
before 0:3.0.2-2.el8_1 | 0:3.0.2-2.el8_1 |
dotnet-apphost-pack-3.0-debuginfoRed Hat:enterprise_linux:8::appstream From an advisory covering 2 CVEs |
before 0:3.0.2-2.el8_1 | 0:3.0.2-2.el8_1 |
dotnet-hostRed Hat:enterprise_linux:8::appstream From an advisory covering 2 CVEs |
before 0:3.0.2-2.el8_1 | 0:3.0.2-2.el8_1 |
dotnet-host-debuginfoRed Hat:enterprise_linux:8::appstream From an advisory covering 2 CVEs |
before 0:3.0.2-2.el8_1 | 0:3.0.2-2.el8_1 |
dotnet-hostfxr-3.0Red Hat:enterprise_linux:8::appstream From an advisory covering 2 CVEs |
before 0:3.0.2-2.el8_1 | 0:3.0.2-2.el8_1 |
dotnet-hostfxr-3.0-debuginfoRed Hat:enterprise_linux:8::appstream From an advisory covering 2 CVEs |
before 0:3.0.2-2.el8_1 | 0:3.0.2-2.el8_1 |
dotnet-runtime-3.0Red Hat:enterprise_linux:8::appstream From an advisory covering 2 CVEs |
before 0:3.0.2-2.el8_1 | 0:3.0.2-2.el8_1 |
dotnet-runtime-3.0-debuginfoRed Hat:enterprise_linux:8::appstream From an advisory covering 2 CVEs |
before 0:3.0.2-2.el8_1 | 0:3.0.2-2.el8_1 |
dotnet-sdk-3.0Red Hat:enterprise_linux:8::appstream From an advisory covering 2 CVEs |
before 0:3.0.102-2.el8_1 | 0:3.0.102-2.el8_1 |
dotnet-sdk-3.0-debuginfoRed Hat:enterprise_linux:8::appstream From an advisory covering 2 CVEs |
before 0:3.0.102-2.el8_1 | 0:3.0.102-2.el8_1 |
dotnet-targeting-pack-3.0Red Hat:enterprise_linux:8::appstream From an advisory covering 2 CVEs |
before 0:3.0.2-2.el8_1 | 0:3.0.2-2.el8_1 |
dotnet-templates-3.0Red Hat:enterprise_linux:8::appstream From an advisory covering 2 CVEs |
before 0:3.0.102-2.el8_1 | 0:3.0.102-2.el8_1 |
dotnet3.0Red Hat:enterprise_linux:8::appstream From an advisory covering 2 CVEs |
before 0:3.0.102-2.el8_1 | 0:3.0.102-2.el8_1 |
dotnet3.0-debuginfoRed Hat:enterprise_linux:8::appstream From an advisory covering 2 CVEs |
before 0:3.0.102-2.el8_1 | 0:3.0.102-2.el8_1 |
dotnet3.0-debugsourceRed Hat:enterprise_linux:8::appstream From an advisory covering 2 CVEs |
before 0:3.0.102-2.el8_1 | 0:3.0.102-2.el8_1 |
netstandard-targeting-pack-2.1Red Hat:enterprise_linux:8::appstream From an advisory covering 2 CVEs |
before 0:3.0.102-2.el8_1 | 0:3.0.102-2.el8_1 |
rh-dotnet30-aspnetcore-runtime-3.0Red Hat:rhel_dotnet:3.0::el7 From an advisory covering 2 CVEs |
before 0:3.0.2-3.el7 | 0:3.0.2-3.el7 |
rh-dotnet30-aspnetcore-targeting-pack-3.0Red Hat:rhel_dotnet:3.0::el7 From an advisory covering 2 CVEs |
before 0:3.0.2-3.el7 | 0:3.0.2-3.el7 |
rh-dotnet30-dotnetRed Hat:rhel_dotnet:3.0::el7 From an advisory covering 2 CVEs |
before 0:3.0.102-3.el7 | 0:3.0.102-3.el7 |
rh-dotnet30-dotnet-apphost-pack-3.0Red Hat:rhel_dotnet:3.0::el7 From an advisory covering 2 CVEs |
before 0:3.0.2-3.el7 | 0:3.0.2-3.el7 |
rh-dotnet30-dotnet-debuginfoRed Hat:rhel_dotnet:3.0::el7 From an advisory covering 2 CVEs |
before 0:3.0.102-3.el7 | 0:3.0.102-3.el7 |
rh-dotnet30-dotnet-hostRed Hat:rhel_dotnet:3.0::el7 From an advisory covering 2 CVEs |
before 0:3.0.2-3.el7 | 0:3.0.2-3.el7 |
rh-dotnet30-dotnet-hostfxr-3.0Red Hat:rhel_dotnet:3.0::el7 From an advisory covering 2 CVEs |
before 0:3.0.2-3.el7 | 0:3.0.2-3.el7 |
rh-dotnet30-dotnet-runtime-3.0Red Hat:rhel_dotnet:3.0::el7 From an advisory covering 2 CVEs |
before 0:3.0.2-3.el7 | 0:3.0.2-3.el7 |
rh-dotnet30-dotnet-sdk-3.0Red Hat:rhel_dotnet:3.0::el7 From an advisory covering 2 CVEs |
before 0:3.0.102-3.el7 | 0:3.0.102-3.el7 |
rh-dotnet30-dotnet-targeting-pack-3.0Red Hat:rhel_dotnet:3.0::el7 From an advisory covering 2 CVEs |
before 0:3.0.2-3.el7 | 0:3.0.2-3.el7 |
rh-dotnet30-dotnet-templates-3.0Red Hat:rhel_dotnet:3.0::el7 From an advisory covering 2 CVEs |
before 0:3.0.102-3.el7 | 0:3.0.102-3.el7 |
rh-dotnet30-netstandard-targeting-pack-2.1Red Hat:rhel_dotnet:3.0::el7 From an advisory covering 2 CVEs |
before 0:3.0.102-3.el7 | 0:3.0.102-3.el7 |
rh-dotnet31-aspnetcore-runtime-3.1Red Hat:rhel_dotnet:3.1::el7 From an advisory covering 2 CVEs |
before 0:3.1.1-4.el7 | 0:3.1.1-4.el7 |
rh-dotnet31-aspnetcore-targeting-pack-3.1Red Hat:rhel_dotnet:3.1::el7 From an advisory covering 2 CVEs |
before 0:3.1.1-4.el7 | 0:3.1.1-4.el7 |
rh-dotnet31-dotnetRed Hat:rhel_dotnet:3.1::el7 From an advisory covering 2 CVEs |
before 0:3.1.101-4.el7 | 0:3.1.101-4.el7 |
rh-dotnet31-dotnet-apphost-pack-3.1Red Hat:rhel_dotnet:3.1::el7 From an advisory covering 2 CVEs |
before 0:3.1.1-4.el7 | 0:3.1.1-4.el7 |
rh-dotnet31-dotnet-debuginfoRed Hat:rhel_dotnet:3.1::el7 From an advisory covering 2 CVEs |
before 0:3.1.101-4.el7 | 0:3.1.101-4.el7 |
rh-dotnet31-dotnet-hostRed Hat:rhel_dotnet:3.1::el7 From an advisory covering 2 CVEs |
before 0:3.1.1-4.el7 | 0:3.1.1-4.el7 |
rh-dotnet31-dotnet-hostfxr-3.1Red Hat:rhel_dotnet:3.1::el7 From an advisory covering 2 CVEs |
before 0:3.1.1-4.el7 | 0:3.1.1-4.el7 |
rh-dotnet31-dotnet-runtime-3.1Red Hat:rhel_dotnet:3.1::el7 From an advisory covering 2 CVEs |
before 0:3.1.1-4.el7 | 0:3.1.1-4.el7 |
rh-dotnet31-dotnet-sdk-3.1Red Hat:rhel_dotnet:3.1::el7 From an advisory covering 2 CVEs |
before 0:3.1.101-4.el7 | 0:3.1.101-4.el7 |
rh-dotnet31-dotnet-targeting-pack-3.1Red Hat:rhel_dotnet:3.1::el7 From an advisory covering 2 CVEs |
before 0:3.1.1-4.el7 | 0:3.1.1-4.el7 |
rh-dotnet31-dotnet-templates-3.1Red Hat:rhel_dotnet:3.1::el7 From an advisory covering 2 CVEs |
before 0:3.1.101-4.el7 | 0:3.1.101-4.el7 |
rh-dotnet31-netstandard-targeting-pack-2.1Red Hat:rhel_dotnet:3.1::el7 From an advisory covering 2 CVEs |
before 0:3.1.101-4.el7 | 0:3.1.101-4.el7 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-0603 is a high vulnerability (CVSS 8.8) in Microsoft Asp.net Core, published January 14, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 22.6%, the 97th percentile. Fixed in Microsoft.AspNetCore.All 2.1.15.
References
portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0603
access.redhat.com/errata/RHSA-2020:0130
nvd.nist.gov/vuln/detail/CVE-2020-0603
github.com/aspnet/Announcements/issues/403
Show 16 moreShow less
bugzilla.redhat.com/show_bug.cgi?id=1788171
security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_0130.json
cve.org/CVERecord?id=CVE-2020-0602