GitHub Advisoryadvisory · NuGet
GHSA-365p-96qv-xr7g ASP.NET Core allow an elevation of privilege
HIGH
Official page ↗
- Aliases
- CVE-2018-0787
- Ecosystem
- NuGet
- Packages
- Microsoft.AspNetCore.HttpOverrides, Microsoft.AspNetCore.Server.Kestrel.Core
- Severity
- High
- CVSS vector
- CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-640
- Reviewed
- 2020-06-16
Affected packages
• NuGet Microsoft.AspNetCore.HttpOverrides: >= 2.0.0, < 2.0.2 → fixed in 2.0.2
• NuGet Microsoft.AspNetCore.Server.Kestrel.Core: >= 2.0.0, < 2.0.2 → fixed in 2.0.2
Description
ASP.NET Core 1.0. 1.1, and 2.0 allow an elevation of privilege vulnerability due to how web applications that are created from templates validate web requests, aka "ASP.NET Core Elevation Of Privilege Vulnerability".
Related
Alias · CVE (1)
- CVE-2018-0787 ASP.NET Core 1.0. vulnerability
Weakness · CWE (1)
- CWE-640 Weak Password Recovery Mechanism for Forgotten Password weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2018-0787 advisory
- https://github.com/aspnet/Announcements/issues/295 web
- https://github.com/advisories/GHSA-365p-96qv-xr7g advisory
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0787 web
- http://www.securityfocus.com/bid/103282 web
- http://www.securitytracker.com/id/1040525 web