ASP.NET Core and Visual Studio Information Disclosure Vulnerability

Summary

CVE	CVE-2021-34532
State	PUBLISHED
Assigner	microsoft
Source Priority	CVE Program / NVD first with legacy fallback
Published	2021-08-12 18:15:09 UTC
Updated	2026-08-10 16:17:57 UTC
Description	ASP.NET Core and Visual Studio Information Disclosure Vulnerability

Risk And Classification

Primary CVSS: v3.1 5.5 MEDIUM from [email protected]

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS: 0.012090000 probability, percentile 0.655530000 (date 2026-08-11)

Problem Types: NVD-CWE-noinfo | Information Disclosure

Version	Source	Type	Score	Severity	Vector
3.1	[email protected]	Secondary	5.5	MEDIUM	`CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N`
3.1	[email protected]	Secondary	5.5	MEDIUM	`CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N`
3.1	CNA	CVSS	5.5	MEDIUM	`CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C`
2.0	[email protected]	Primary	2.1		`AV:L/AC:L/Au:N/C:P/I:N/A:N`

CVSS v3.1 Breakdown

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CVSS v2.0 Breakdown

Access Vector

Local

Access Complexity

Low

Authentication

None

Confidentiality

Partial

Integrity

None

Availability

None

AV:L/AC:L/Au:N/C:P/I:N/A:N

NVD Known Affected Configurations (CPE 2.3)

Type	Vendor	Product	Version	Update	Edition	Language
Application	Microsoft	Asp.net Core	All	All	All	All
Application	Microsoft	Asp.net Core	All	All	All	All
Application	Microsoft	Asp.net Core	All	All	All	All
Application	Microsoft	Visual Studio 2019	8.10	All	All	All
Application	Microsoft	Visual Studio 2019	All	All	All	All

Vendor Declared Affected Products

Source	Vendor	Product	Version	Platforms
CNA	Microsoft	ASP.NET Core 2.1	affected 2.0 2.1.29 custom	Not specified
CNA	Microsoft	ASP.NET Core 3.1	affected 3.0 3.1.18 custom	Not specified
CNA	Microsoft	ASP.NET Core 5.0	affected 5.0 5.0.9 custom	Not specified
CNA	Microsoft	Microsoft Visual Studio 2019 Version 16.10 Includes 16.0 - 16.9	affected 16.10.0 16.10.5 custom	Not specified
CNA	Microsoft	Microsoft Visual Studio 2019 Version 16.4 Includes 16.0 - 16.3	affected 16.0 16.4.25 custom	Not specified
CNA	Microsoft	Microsoft Visual Studio 2019 Version 16.7 Includes 16.0 16.6	affected 16.0.0 16.7.18 custom	Not specified
CNA	Microsoft	Microsoft Visual Studio 2019 Version 16.9 Includes 16.0 - 16.8	affected 15.0.0 16.9.10 custom	Not specified
CNA	Microsoft	Visual Studio 2019 For Mac Version 8.10	affected 8.1.0 8.10.7 custom	Not specified

References

Reference	Source	Link	Tags
Security Update Guide - Microsoft Security Response Center	af854a3a-2127-422b-91ae-364da2661108	portal.msrc.microsoft.com	Patch, Vendor Advisory
msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34532	[email protected]	msrc.microsoft.com
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

No vendor comments have been submitted for this CVE.

Legacy QID Mappings

159350 Oracle Enterprise Linux Security Update for .NET Core 3.1 (ELSA-2021-3142)
159352 Oracle Enterprise Linux Security Update for .NET 5.0 (ELSA-2021-3148)
239550 Red Hat Update for .NET 5.0 (RHSA-2021:3148)
239551 Red Hat Update for .NET 5.0 on RHEL 7 (RHSA-2021:3147)
239553 Red Hat Update for .NET Core 3.1 on RHEL 7 (RHSA-2021:3143)
239554 Red Hat Update for .NET Core 3.1 (RHSA-2021:3142)
377162 Alibaba Cloud Linux Security Update for .net core 3.1 (ALINUX3-SA-2021:0062)
91807 Microsoft .NET Core and ASP.NET Core Security Update for August 2021
91809 Microsoft Visual Studio Security Update for August 2021
940040 AlmaLinux Security Update for .NET (ALSA-2021:3148)
940107 AlmaLinux Security Update for .NET (ALSA-2021:3142)
960025 Rocky Linux Security Update for .NET (RLSA-2021:3142)
960028 Rocky Linux Security Update for .NET (RLSA-2021:3148)
980384 Dotnet (nuget) Security Update for Microsoft.AspNetCore.Authentication.JwtBearer (GHSA-q7cg-43mg-qp69)