CVE-2024-50353: ICG.AspNetCore.Utilities.CloudStorage's Secure Token Durations Different Than Expected
First published: Wed Oct 30 2024(Updated: )
### Impact Users of this library that set a duration for a SAS Uri with a value other than 1 hour may have generated a URL with a duration that is longer, or shorter than desired. Users not implemented SAS Uri's are unaffected. ### Patches This issue was resolved in version 8.0.0 of the library, all users should update to this version ASAP. ### Workarounds None
Credit: security-advisories@github.com security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| nuget/ICG.AspNetCore.Utilities.CloudStorage | <8.0.0 | 8.0.0 |
| Iowacomputergurus Aspnetcore.utilities.cloudstorage | <8.0.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/IowaComputerGurus/aspnetcore.utilities.cloudstorage/security/advisories/GHSA-24mc-gc52-47jv
- https://github.com/IowaComputerGurus/aspnetcore.utilities.cloudstorage/commit/8ea534481181a063175f457082662fdcad9a41ff
- https://nvd.nist.gov/vuln/detail/CVE-2024-50353
- https://github.com/advisories/GHSA-24mc-gc52-47jv (Advisory)
Frequently Asked Questions
What is the severity of CVE-2024-50353?
The severity of CVE-2024-50353 is moderate due to potential unauthorized access through misconfigured SAS URIs.
How do I fix CVE-2024-50353?
To fix CVE-2024-50353, upgrade the ICG.AspNetCore.Utilities.CloudStorage package to version 8.0.0 or later.
Who is affected by CVE-2024-50353?
Users of the ICG.AspNetCore.Utilities.CloudStorage library who configure SAS URIs with a duration other than 1 hour are affected.
What impact does CVE-2024-50353 have on users?
CVE-2024-50353 may result in SAS URIs with unintended durations, leading to potential security vulnerabilities.
Is there a workaround for CVE-2024-50353?
There is no documented workaround for CVE-2024-50353, so updating to the latest version is recommended.
- agent/title
- agent/weakness
- agent/type
- agent/first-publish-date
- agent/description
- agent/event
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-24mc-gc52-47jv
- alias/CVE-2024-50353
- agent/software-canonical-lookup
- agent/references
- agent/author
- collector/mitre-cve
- source/MITRE
- collector/nvd-cve
- source/NVD
- collector/github-advisory
- agent/last-modified-date
- agent/severity
- agent/remedy
- collector/nvd-api
- agent/software-canonical-lookup-request
- agent/softwarecombine
- agent/trending
- agent/tags
- agent/source
- package-manager/nuget
- vendor/iowacomputergurus
- canonical/iowacomputergurus aspnetcore.utilities.cloudstorage