Search for vulnerabilities
Vulnerability details: VCID-m6qq-pv1j-hqb3
Vulnerability ID VCID-m6qq-pv1j-hqb3
Aliases CVE-2025-24070
GHSA-2865-hh9g-w894
Summary dotnet: Privilege Escalation Vulnerability in .NET SignInManager.RefreshSignInAsync Method
Status Published
Exploitability 0.5
Weighted Severity 8.0
Risk 4.0
Affected and Fixed Packages Package Details
Weaknesses (4)
CWE-269 Improper Privilege Management
CWE-1390 Weak Authentication
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3 7.8 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-24070.json
epss 0.00117 https://api.first.org/data/v1/epss?cve=CVE-2025-24070
epss 0.00117 https://api.first.org/data/v1/epss?cve=CVE-2025-24070
epss 0.00117 https://api.first.org/data/v1/epss?cve=CVE-2025-24070
epss 0.00117 https://api.first.org/data/v1/epss?cve=CVE-2025-24070
epss 0.00117 https://api.first.org/data/v1/epss?cve=CVE-2025-24070
epss 0.00117 https://api.first.org/data/v1/epss?cve=CVE-2025-24070
epss 0.00117 https://api.first.org/data/v1/epss?cve=CVE-2025-24070
epss 0.00117 https://api.first.org/data/v1/epss?cve=CVE-2025-24070
epss 0.00117 https://api.first.org/data/v1/epss?cve=CVE-2025-24070
epss 0.00117 https://api.first.org/data/v1/epss?cve=CVE-2025-24070
epss 0.00119 https://api.first.org/data/v1/epss?cve=CVE-2025-24070
epss 0.00123 https://api.first.org/data/v1/epss?cve=CVE-2025-24070
epss 0.00123 https://api.first.org/data/v1/epss?cve=CVE-2025-24070
epss 0.00123 https://api.first.org/data/v1/epss?cve=CVE-2025-24070
epss 0.00123 https://api.first.org/data/v1/epss?cve=CVE-2025-24070
epss 0.00123 https://api.first.org/data/v1/epss?cve=CVE-2025-24070
epss 0.00123 https://api.first.org/data/v1/epss?cve=CVE-2025-24070
epss 0.00123 https://api.first.org/data/v1/epss?cve=CVE-2025-24070
epss 0.00123 https://api.first.org/data/v1/epss?cve=CVE-2025-24070
epss 0.00123 https://api.first.org/data/v1/epss?cve=CVE-2025-24070
epss 0.00123 https://api.first.org/data/v1/epss?cve=CVE-2025-24070
epss 0.00123 https://api.first.org/data/v1/epss?cve=CVE-2025-24070
epss 0.00123 https://api.first.org/data/v1/epss?cve=CVE-2025-24070
epss 0.00123 https://api.first.org/data/v1/epss?cve=CVE-2025-24070
epss 0.00123 https://api.first.org/data/v1/epss?cve=CVE-2025-24070
epss 0.00123 https://api.first.org/data/v1/epss?cve=CVE-2025-24070
epss 0.00123 https://api.first.org/data/v1/epss?cve=CVE-2025-24070
epss 0.00123 https://api.first.org/data/v1/epss?cve=CVE-2025-24070
epss 0.00123 https://api.first.org/data/v1/epss?cve=CVE-2025-24070
epss 0.00123 https://api.first.org/data/v1/epss?cve=CVE-2025-24070
epss 0.00123 https://api.first.org/data/v1/epss?cve=CVE-2025-24070
epss 0.00123 https://api.first.org/data/v1/epss?cve=CVE-2025-24070
epss 0.00123 https://api.first.org/data/v1/epss?cve=CVE-2025-24070
epss 0.00123 https://api.first.org/data/v1/epss?cve=CVE-2025-24070
epss 0.00123 https://api.first.org/data/v1/epss?cve=CVE-2025-24070
epss 0.00123 https://api.first.org/data/v1/epss?cve=CVE-2025-24070
epss 0.00123 https://api.first.org/data/v1/epss?cve=CVE-2025-24070
epss 0.00123 https://api.first.org/data/v1/epss?cve=CVE-2025-24070
epss 0.00123 https://api.first.org/data/v1/epss?cve=CVE-2025-24070
epss 0.00136 https://api.first.org/data/v1/epss?cve=CVE-2025-24070
epss 0.00136 https://api.first.org/data/v1/epss?cve=CVE-2025-24070
epss 0.00136 https://api.first.org/data/v1/epss?cve=CVE-2025-24070
epss 0.00136 https://api.first.org/data/v1/epss?cve=CVE-2025-24070
epss 0.00136 https://api.first.org/data/v1/epss?cve=CVE-2025-24070
epss 0.00136 https://api.first.org/data/v1/epss?cve=CVE-2025-24070
epss 0.00136 https://api.first.org/data/v1/epss?cve=CVE-2025-24070
epss 0.00136 https://api.first.org/data/v1/epss?cve=CVE-2025-24070
epss 0.00136 https://api.first.org/data/v1/epss?cve=CVE-2025-24070
epss 0.00136 https://api.first.org/data/v1/epss?cve=CVE-2025-24070
epss 0.00136 https://api.first.org/data/v1/epss?cve=CVE-2025-24070
epss 0.00136 https://api.first.org/data/v1/epss?cve=CVE-2025-24070
epss 0.00136 https://api.first.org/data/v1/epss?cve=CVE-2025-24070
epss 0.00136 https://api.first.org/data/v1/epss?cve=CVE-2025-24070
epss 0.00136 https://api.first.org/data/v1/epss?cve=CVE-2025-24070
epss 0.00136 https://api.first.org/data/v1/epss?cve=CVE-2025-24070
epss 0.00136 https://api.first.org/data/v1/epss?cve=CVE-2025-24070
epss 0.00136 https://api.first.org/data/v1/epss?cve=CVE-2025-24070
epss 0.00136 https://api.first.org/data/v1/epss?cve=CVE-2025-24070
epss 0.00136 https://api.first.org/data/v1/epss?cve=CVE-2025-24070
epss 0.00136 https://api.first.org/data/v1/epss?cve=CVE-2025-24070
epss 0.00136 https://api.first.org/data/v1/epss?cve=CVE-2025-24070
epss 0.00136 https://api.first.org/data/v1/epss?cve=CVE-2025-24070
epss 0.00136 https://api.first.org/data/v1/epss?cve=CVE-2025-24070
epss 0.00155 https://api.first.org/data/v1/epss?cve=CVE-2025-24070
epss 0.00155 https://api.first.org/data/v1/epss?cve=CVE-2025-24070
epss 0.00155 https://api.first.org/data/v1/epss?cve=CVE-2025-24070
epss 0.00155 https://api.first.org/data/v1/epss?cve=CVE-2025-24070
epss 0.00155 https://api.first.org/data/v1/epss?cve=CVE-2025-24070
epss 0.00155 https://api.first.org/data/v1/epss?cve=CVE-2025-24070
epss 0.00155 https://api.first.org/data/v1/epss?cve=CVE-2025-24070
epss 0.00155 https://api.first.org/data/v1/epss?cve=CVE-2025-24070
epss 0.00155 https://api.first.org/data/v1/epss?cve=CVE-2025-24070
epss 0.00155 https://api.first.org/data/v1/epss?cve=CVE-2025-24070
epss 0.00155 https://api.first.org/data/v1/epss?cve=CVE-2025-24070
epss 0.00155 https://api.first.org/data/v1/epss?cve=CVE-2025-24070
cvssv3.1_qr HIGH https://github.com/advisories/GHSA-2865-hh9g-w894
cvssv3.1 7.0 https://github.com/dotnet/aspnetcore
generic_textual HIGH https://github.com/dotnet/aspnetcore
cvssv3.1 7.0 https://github.com/dotnet/aspnetcore/security/advisories/GHSA-2865-hh9g-w894
cvssv3.1_qr HIGH https://github.com/dotnet/aspnetcore/security/advisories/GHSA-2865-hh9g-w894
generic_textual HIGH https://github.com/dotnet/aspnetcore/security/advisories/GHSA-2865-hh9g-w894
cvssv3.1 7 https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24070
cvssv3.1 7.0 https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24070
generic_textual HIGH https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24070
ssvc Track https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24070
cvssv3.1 7.0 https://nvd.nist.gov/vuln/detail/CVE-2025-24070
generic_textual HIGH https://nvd.nist.gov/vuln/detail/CVE-2025-24070
cvssv3.1 7.0 https://www.herodevs.com/vulnerability-directory/cve-2025-24070
generic_textual HIGH https://www.herodevs.com/vulnerability-directory/cve-2025-24070
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-24070.json
https://api.first.org/data/v1/epss?cve=CVE-2025-24070
https://github.com/dotnet/aspnetcore
2349733 https://bugzilla.redhat.com/show_bug.cgi?id=2349733
CVE-2025-24070 https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24070
CVE-2025-24070 https://nvd.nist.gov/vuln/detail/CVE-2025-24070
CVE-2025-24070 https://www.herodevs.com/vulnerability-directory/cve-2025-24070
GHSA-2865-hh9g-w894 https://github.com/advisories/GHSA-2865-hh9g-w894
GHSA-2865-hh9g-w894 https://github.com/dotnet/aspnetcore/security/advisories/GHSA-2865-hh9g-w894
RHSA-2025:2666 https://access.redhat.com/errata/RHSA-2025:2666
RHSA-2025:2667 https://access.redhat.com/errata/RHSA-2025:2667
RHSA-2025:2668 https://access.redhat.com/errata/RHSA-2025:2668
RHSA-2025:2669 https://access.redhat.com/errata/RHSA-2025:2669
RHSA-2025:2670 https://access.redhat.com/errata/RHSA-2025:2670
USN-7345-1 https://usn.ubuntu.com/7345-1/
No exploits are available.
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-24070.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H Found at https://github.com/dotnet/aspnetcore
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H Found at https://github.com/dotnet/aspnetcore/security/advisories/GHSA-2865-hh9g-w894
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H/E:U/RL:O/RC:C Found at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24070
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H Found at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24070
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-03-11T18:23:50Z/ Found at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24070
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2025-24070
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H Found at https://www.herodevs.com/vulnerability-directory/cve-2025-24070
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.31878
EPSS Score 0.00117
Published At May 7, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2025-03-28T05:41:56.273059+00:00 RedHat Importer Import https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-24070.json 36.0.0