CVE-2025-24070 Common Vulnerabilities and Exposures

Upstream information

CVE-2025-24070 at MITRE

Description

Weak authentication in ASP.NET Core & Visual Studio allows an unauthorized attacker to elevate privileges over a network.

SUSE information

Overall state of this security issue: Does not affect SUSE products

This issue is currently rated as having moderate severity.

CVSS v3 Scores
	CNA (Microsoft)
Base Score	7
Vector	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H
Attack Vector	Network
Attack Complexity	High
Privileges Required	None
User Interaction	None
Scope	Unchanged
Confidentiality Impact	Low
Integrity Impact	Low
Availability Impact	High
CVSSv3 Version	3.1

No SUSE Bugzilla entries cross referenced.

SUSE Security Advisories:

RHSA-2025:2667, published Wed Mar 19 16:06:17 UTC 2025
RHSA-2025:2668, published Wed Mar 19 16:06:18 UTC 2025
RHSA-2025:2669, published Wed Mar 19 16:06:18 UTC 2025
RHSA-2025:2670, published Wed Mar 19 16:06:17 UTC 2025

List of released packages

Product(s)	Fixed package version(s)	References
SUSE Liberty Linux 8	`aspnetcore-runtime-8.0 >= 8.0.14-1.el8_10` `aspnetcore-runtime-9.0 >= 9.0.3-1.el8_10` `aspnetcore-runtime-dbg-8.0 >= 8.0.14-1.el8_10` `aspnetcore-runtime-dbg-9.0 >= 9.0.3-1.el8_10` `aspnetcore-targeting-pack-8.0 >= 8.0.14-1.el8_10` `aspnetcore-targeting-pack-9.0 >= 9.0.3-1.el8_10` `dotnet >= 9.0.104-1.el8_10` `dotnet-apphost-pack-8.0 >= 8.0.14-1.el8_10` `dotnet-apphost-pack-9.0 >= 9.0.3-1.el8_10` `dotnet-host >= 9.0.3-1.el8_10` `dotnet-hostfxr-8.0 >= 8.0.14-1.el8_10` `dotnet-hostfxr-9.0 >= 9.0.3-1.el8_10` `dotnet-runtime-8.0 >= 8.0.14-1.el8_10` `dotnet-runtime-9.0 >= 9.0.3-1.el8_10` `dotnet-runtime-dbg-8.0 >= 8.0.14-1.el8_10` `dotnet-runtime-dbg-9.0 >= 9.0.3-1.el8_10` `dotnet-sdk-8.0 >= 8.0.114-1.el8_10` `dotnet-sdk-8.0-source-built-artifacts >= 8.0.114-1.el8_10` `dotnet-sdk-9.0 >= 9.0.104-1.el8_10` `dotnet-sdk-9.0-source-built-artifacts >= 9.0.104-1.el8_10` `dotnet-sdk-aot-9.0 >= 9.0.104-1.el8_10` `dotnet-sdk-dbg-8.0 >= 8.0.114-1.el8_10` `dotnet-sdk-dbg-9.0 >= 9.0.104-1.el8_10` `dotnet-targeting-pack-8.0 >= 8.0.14-1.el8_10` `dotnet-targeting-pack-9.0 >= 9.0.3-1.el8_10` `dotnet-templates-8.0 >= 8.0.114-1.el8_10` `dotnet-templates-9.0 >= 9.0.104-1.el8_10` `netstandard-targeting-pack-2.1 >= 9.0.104-1.el8_10`	Patchnames: RHSA-2025:2667 RHSA-2025:2670
SUSE Liberty Linux 9	`aspnetcore-runtime-8.0 >= 8.0.14-1.el9_5` `aspnetcore-runtime-9.0 >= 9.0.3-1.el9_5` `aspnetcore-runtime-dbg-8.0 >= 8.0.14-1.el9_5` `aspnetcore-runtime-dbg-9.0 >= 9.0.3-1.el9_5` `aspnetcore-targeting-pack-8.0 >= 8.0.14-1.el9_5` `aspnetcore-targeting-pack-9.0 >= 9.0.3-1.el9_5` `dotnet-apphost-pack-8.0 >= 8.0.14-1.el9_5` `dotnet-apphost-pack-9.0 >= 9.0.3-1.el9_5` `dotnet-host >= 9.0.3-1.el9_5` `dotnet-hostfxr-8.0 >= 8.0.14-1.el9_5` `dotnet-hostfxr-9.0 >= 9.0.3-1.el9_5` `dotnet-runtime-8.0 >= 8.0.14-1.el9_5` `dotnet-runtime-9.0 >= 9.0.3-1.el9_5` `dotnet-runtime-dbg-8.0 >= 8.0.14-1.el9_5` `dotnet-runtime-dbg-9.0 >= 9.0.3-1.el9_5` `dotnet-sdk-8.0 >= 8.0.114-1.el9_5` `dotnet-sdk-8.0-source-built-artifacts >= 8.0.114-1.el9_5` `dotnet-sdk-9.0 >= 9.0.104-1.el9_5` `dotnet-sdk-9.0-source-built-artifacts >= 9.0.104-1.el9_5` `dotnet-sdk-aot-9.0 >= 9.0.104-1.el9_5` `dotnet-sdk-dbg-8.0 >= 8.0.114-1.el9_5` `dotnet-sdk-dbg-9.0 >= 9.0.104-1.el9_5` `dotnet-targeting-pack-8.0 >= 8.0.14-1.el9_5` `dotnet-targeting-pack-9.0 >= 9.0.3-1.el9_5` `dotnet-templates-8.0 >= 8.0.114-1.el9_5` `dotnet-templates-9.0 >= 9.0.104-1.el9_5` `netstandard-targeting-pack-2.1 >= 9.0.104-1.el9_5`	Patchnames: RHSA-2025:2668 RHSA-2025:2669

SUSE Timeline for this CVE

CVE page created: Tue Mar 11 20:00:03 2025
CVE page last modified: Wed Mar 19 20:06:19 2025