Описание
Insertion of sensitive information into sent data in .NET allows an unauthorized attacker to disclose information over a network.
Отчет
A moderate information disclosure vulnerability was found in the .NET runtime. When a .NET application using SocketsHttpHandler sends a request through a proxy that authenticates with basic credentials and the response is an HTTP redirect, the Proxy-Authorization header can be incorrectly retained and forwarded with the redirected request, leaking the basic proxy credentials to the destination server. This allows an unauthorized remote attacker to disclose sensitive proxy authentication information over a network. Red Hat rates this flaw Moderate severity with a CVSS 3.1 base score of 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N), consistent with the upstream assessment. All currently tracked Red Hat product streams shipping the affected dotnet8.0, dotnet9.0, and dotnet10.0 components, including Red Hat Enterprise Linux and Red Hat Hardened Images, are affected, and fixes are being pursued through the respective product channels.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Дополнительная информация
Статус:
EPSS
5.9 Medium
CVSS3
Связанные уязвимости
Insertion of sensitive information into sent data in .NET allows an unauthorized attacker to disclose information over a network.
Insertion of sensitive information into sent data in .NET allows an unauthorized attacker to disclose information over a network.
Microsoft Security Advisory CVE-2026-66822 - .NET and Visual Studio Information Disclosure Vulnerability
EPSS
5.9 Medium
CVSS3