ICG.AspNetCore.Utilities.CloudStorage's Secure Token Durations Different Than Expected
Impact
Users of this library that set a duration for a SAS Uri with a value other than 1 hour may have generated a URL with a duration that is longer, or shorter than desired.
Users not implemented SAS Uri's are unaffected.
Patches
This issue was resolved in version 8.0.0 of the library, all users should update to this version ASAP.
Workarounds
None
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| .NET (NuGet) | ICG.AspNetCore.Utilities.CloudStorage | < 8.0.0 | 8.0.0 |
References
- https://github.com/IowaComputerGurus/aspnetcore.utilities.cloudstorage/security/advisories/GHSA-24mc-gc52-47jv
- https://nvd.nist.gov/vuln/detail/CVE-2024-50353
- https://github.com/IowaComputerGurus/aspnetcore.utilities.cloudstorage/commit/8ea534481181a063175f457082662fdcad9a41ff
- https://github.com/IowaComputerGurus/aspnetcore.utilities.cloudstorage
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N- Weakness (CWE)
CWE-284- Platform
- .NET (NuGet)
- Package
ICG.AspNetCore.Utilities.CloudStorage- Disclosed
- 30.10.2024
- Updated
- 11.10.2026 11:23
Sources and licenses
OSV / GitHub Advisory Database - GHSA-24mc-gc52-47jv - CC BY 4.0
Vulnerability history: ICG.AspNetCore.Utilities.CloudStorage
All published vulnerabilities of this package (.NET (NuGet)), newest first. Shows whether this is a one-off slip or a package that needs watching.
This is the only known vulnerability of this package.
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.