CVE-2020-1476: 
vulnerability analysis and mitigation

An elevation of privilege vulnerability (CVE-2020-1476) was identified in ASP.NET or .NET web applications running on IIS that improperly allow access to cached files. The vulnerability was disclosed in August 2020 and affects multiple versions of Microsoft .NET Framework (versions 2.0 SP2 through 4.8) running on various Windows operating systems including Windows 7, 8.1, 10, and Windows Server editions (NVD).

The vulnerability has been assigned a CVSS v3.1 base score of 5.5 (Medium) with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. The vulnerability requires local access and low attack complexity, with no user interaction needed. While it has high confidentiality impact, it does not affect integrity or availability (NVD).

If successfully exploited, this vulnerability could allow an attacker to gain access to restricted files. The attacker would need to send a specially crafted request to an affected server to exploit the vulnerability (MITRE CVE).

To exploit this vulnerability, an attacker would need to send a specially crafted request to an affected server. The attack requires local access and low complexity to execute (Microsoft Support).

Microsoft has addressed the vulnerability by changing how ASP.NET and .NET Framework handle requests. The fix is available through security updates for all affected versions of .NET Framework. System administrators are advised to apply the relevant security updates (Microsoft Support).