CVE-2015-1648: Low severity microsoft .net framework 4 vulnerability

Published Apr 14, 2015

Updated

ASP.NET in Microsoft .NET Framework 1.1 SP1, 2.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, and 4.5.2, when the customErrors configuration is disabled, allows remote attackers to obtain sensitive configuration-file information via a crafted request, aka "ASP.NET Information Disclosure Vulnerability."

Affected Software

8 affected components

Microsoft .NET Framework=1.1-sp1

Microsoft .NET Framework=2.0-sp2

Microsoft .NET Framework=3.5

Microsoft .NET Framework=3.5.1

Microsoft .NET Framework=4.0

Microsoft .NET Framework=4.5

Microsoft .NET Framework=4.5.1

Microsoft .NET Framework=4.5.2

Event History

Apr 14, 2015

CVE Published

via MITRE·08:00 PM

Data Sourced

via MITRE·08:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2015-1648?

CVE-2015-1648 has a medium severity rating due to its potential for information disclosure.

How do I fix CVE-2015-1648?

To fix CVE-2015-1648, enable the customErrors configuration in your ASP.NET application to mitigate sensitive information disclosure.

What versions of .NET Framework are affected by CVE-2015-1648?

CVE-2015-1648 affects .NET Framework versions 1.1 SP1, 2.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, and 4.5.2.

What attack vector is associated with CVE-2015-1648?

CVE-2015-1648 can be exploited by remote attackers sending crafted requests to obtain sensitive configuration file information.

Is there a workaround for CVE-2015-1648 if I cannot upgrade?

A possible workaround for CVE-2015-1648 is to restrict access to the ASP.NET application to trusted users while enabling customErrors.