Description
Incorrect default permissions in ASP.NET Core allows an authorized attacker to elevate privileges locally.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Microsoft .NET 10.0 installed on Linux
10.0.0 to < 10.0.403affected
Microsoft .NET 10.0 installed on Mac OS
10.0.0 to < 10.0.403affected
Microsoft .NET 10.0 installed on Windows
10.0.0 to < 10.0.403affected
Microsoft .NET 11.0 installed on Linux
11.0.0-preview.1 to < 11.0.100-rc.3affected
Microsoft .NET 11.0 installed on Mac OS
11.0.0-preview.1 to < 11.0.100-rc.3affected
Microsoft .NET 11.0 installed on Windows
11.0.0-preview.1 to < 11.0.100-rc.3affected
Microsoft .NET 8.0 installed on Linux
8.0.0 to < 8.0.427affected
Microsoft .NET 8.0 installed on Mac OS
8.0.0 to < 8.0.427affected
Microsoft .NET 8.0 installed on Windows
8.0.0 to < 8.0.427affected
Microsoft .NET 9.0 installed on Linux
9.0.0 to < 9.0.320affected
Microsoft .NET 9.0 installed on Mac OS
9.0.0 to < 9.0.320affected
Microsoft .NET 9.0 installed on Windows
9.0.0 to < 9.0.320affected
Microsoft .NET source-build Linux tarballs (all archive types)
8.0.100 to < 10.0.403-servicing.26523.112affected
Microsoft ASP.NET Core runtime and targeting-pack Linux tarballs (Microsoft-published)
8.0.0 to < 9.0.22affected