GitHub Advisoryadvisory · NuGet

GHSA-3wcj-rg8q-9cqv Open redirect in ASP.NET Core

HIGH Published 2022-05-14 Modified 2022-07-08 Official page ↗
Aliases
CVE-2017-11879
Ecosystem
NuGet
Packages
Microsoft.AspNetCore.All, Microsoft.AspNetCore.Mvc.Core
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-601
Reviewed
2022-07-08

Affected packages

• NuGet Microsoft.AspNetCore.All: >= 2.0.0, < 2.0.3 → fixed in 2.0.3 • NuGet Microsoft.AspNetCore.Mvc.Core: >= 2.0.0, < 2.0.1 → fixed in 2.0.1

Description

ASP.NET Core 2.0 allows an attacker to steal log-in session information such as cookies or authentication tokens via a specially crafted URL aka "ASP.NET Core Elevation Of Privilege Vulnerability".

Related

Alias · CVE (1)

  • CVE-2017-11879 ASP.NET Core 2.0 allows an attacker to steal log-in session information such as cookies or authentication tokens via a specially crafted… vulnerability

Weakness · CWE (1)

  • CWE-601 URL Redirection to Untrusted Site weakness

References