CVEvulnerability
CVE-2018-0787
8.8 HIGH
Official page ↗
- Status
- Modified
- Published
- 2018-03-14
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 8.8 HIGH — CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 6.8 MEDIUM — AV:N/AC:M/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-640
Description
ASP.NET Core 1.0. 1.1, and 2.0 allow an elevation of privilege vulnerability due to how web applications that are created from templates validate web requests, aka "ASP.NET Core Elevation Of Privilege Vulnerability".
Affected configurations
• microsoft asp.net core 1.0
• microsoft asp.net core 1.1
• microsoft asp.net core 2.0
Related
Weakness · CWE (1)
- CWE-640 Weak Password Recovery Mechanism for Forgotten Password weakness
References
- http://www.securityfocus.com/bid/103282 Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1040525 Third Party Advisory, VDB Entry
- https://github.com/aspnet/Announcements/issues/295 Technical Description, Third Party Advisory
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0787 Patch, Vendor Advisory
- http://www.securityfocus.com/bid/103282 Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1040525 Third Party Advisory, VDB Entry
- https://github.com/aspnet/Announcements/issues/295 Technical Description, Third Party Advisory
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0787 Patch, Vendor Advisory