GHSA-365p-96qv-xr7g
ASP.NET Core allow an elevation of privilege
At a glance
- Published
- Updated
- CVE
- CVE-2018-0787
- CVSS_V3
- CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Description
ASP.NET Core 1.0. 1.1, and 2.0 allow an elevation of privilege vulnerability due to how web applications that are created from templates validate web requests, aka "ASP.NET Core Elevation Of Privilege Vulnerability".
Affected packages
| Package | Versions |
|---|---|
| NuGet · Microsoft.AspNetCore.HttpOverrides | introduced 2.0.0, fixed 2.0.2 |
| NuGet · Microsoft.AspNetCore.Server.Kestrel.Core | introduced 2.0.0, fixed 2.0.2 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2018-0787 ADVISORY
- https://github.com/aspnet/Announcements/issues/295 WEB
- https://github.com/advisories/GHSA-365p-96qv-xr7g ADVISORY
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0787 WEB
- http://www.securityfocus.com/bid/103282 WEB
- http://www.securitytracker.com/id/1040525 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |