CVE-2025-55315: asp.net core from 2.3.0 (inclusive), before 2.3.6 (exclusive), from 8.0.0 (inclusive), before 8.0.21 (exclusive), from…

Affected technology

asp.net core · from 2.3.0 (inclusive), before 2.3.6 (exclusive)
microsoft

asp.net core · from 8.0.0 (inclusive), before 8.0.21 (exclusive)
microsoft

asp.net core · from 9.0.0 (inclusive), before 9.0.10 (exclusive)
microsoft

visual studio 2022 · from 17.10.0 (inclusive), before 17.10.20 (exclusive)
microsoft

visual studio 2022 · from 17.12.10 (inclusive), before 17.12.13 (exclusive)
microsoft

visual studio 2022 · from 17.14.0 (inclusive), before 17.14.17 (exclusive)
microsoft

ASP.NET Core 2.3 · 2.3 to before 2.3.6
Microsoft

ASP.NET Core 8.0 · 8.0 to before 8.0.21
Microsoft

ASP.NET Core 9.0 · 9.0 to before 9.0.10
Microsoft

Microsoft Visual Studio 2022 version 17.10 · 17.10.0 to before 17.10.20
Microsoft

Microsoft Visual Studio 2022 version 17.12 · 17.12.0 to before 17.12.13
Microsoft

Microsoft Visual Studio 2022 version 17.14 · 17.14.0 to before 17.14.17
Microsoft

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.1): Network (remote) · Low privileges required · No user interaction required

What an attacker can do

An authorized attacker can bypass a security feature over a network. Vendor/CNA’s CVSS 3.1 assessment (base score 9.9/10) rates confidentiality and integrity impact as high; availability impact as low.