iowacomputergurus/aspnetcore.utilities.cloudstorage · Security
ICG.AspNetCore.Utilities.CloudStorage's Secure Token Durations Different Than Expected
- GHSA ID
- GHSA-24mc-gc52-47jv
- CVE ID
- CVE-2024-50353
- Severity
- medium
- Published
- Updated
- CVSS
- 5.3 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- CVSS v3
- 5.3 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- CVSS v4
- 5.5 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
Description
Impact
Users of this library that set a duration for a SAS Uri with a value other than 1 hour may have generated a URL with a duration that is longer, or shorter than desired.
Users not implemented SAS Uri's are unaffected.
Patches
This issue was resolved in version 8.0.0 of the library, all users should update to this version ASAP.
Workarounds
None
CWEs
- CWE-284 · Improper Access Control
References
- https://github.com/IowaComputerGurus/aspnetcore.utilities.cloudstorage/security/advisories/GHSA-24mc-gc52-47jv ↗
- https://github.com/IowaComputerGurus/aspnetcore.utilities.cloudstorage/commit/8ea534481181a063175f457082662fdcad9a41ff ↗
- https://nvd.nist.gov/vuln/detail/CVE-2024-50353 ↗
- https://github.com/advisories/GHSA-24mc-gc52-47jv ↗