PT-2024-34162 · Unknown · Icg.Aspnetcore.Utilities.Cloudstorage

Mitchelsellers · Published 2024-10-30 · Updated 2024-11-13 · CVE-2024-50353

Positive Technologies (AI Summary)

CVSS v4.0

5.5

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P

Name of the Vulnerable Software and Affected Versions: ICG.AspNetCore.Utilities.CloudStorage versions prior to 8.0.0

Description: The issue affects users of the ICG.AspNetCore.Utilities.CloudStorage library who set a duration for a SAS Uri with a value other than 1 hour, potentially resulting in a URL with a duration that is longer or shorter than desired. Users not implementing SAS Uri's are unaffected.

Recommendations: For versions prior to 8.0.0, update to version 8.0.0 of the library to resolve the issue.

Exploit

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2024-50353

GHSA-24MC-GC52-47JV

Affected Products

Icg.Aspnetcore.Utilities.Cloudstorage

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/50xxx/CVE-2024-50353.json · Exploit
• https://github.com/IowaComputerGurus/aspnetcore.utilities.cloudstorage/security/advisories/GHSA-24mc-gc52-47jv · Vendor Advisory
• https://github.com/IowaComputerGurus/aspnetcore.utilities.cloudstorage/commit/8ea534481181a063175f457082662fdcad9a41ff · Patch
• https://osv.dev/vulnerability/CVE-2024-50353 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-50353 · Security Note
• https://osv.dev/vulnerability/GHSA-24mc-gc52-47jv · Vendor Advisory
• https://github.com/IowaComputerGurus/aspnetcore.utilities.cloudstorage · Note
• https://t.me/cvedetector/9427 · Telegram Post