GitHub Advisoryadvisory · NuGet

GHSA-j8f4-2w4p-mhjc Moderate severity vulnerability that affects Microsoft.AspNetCore.Mvc

MEDIUM Published 2018-10-16 Modified 2021-07-01 Official page ↗
Aliases
CVE-2017-0256
Ecosystem
NuGet
Packages
Microsoft.AspNetCore.Mvc, Microsoft.AspNetCore.Mvc.Core, System.Net.Http, System.Text.Encodings.Web, System.Net.Http.WinHttpHandler, System.Net.Security, System.Net.WebSockets.Client, Microsoft.AspNetCore.Mvc.Abstractions, Microsoft.AspNetCore.Mvc.ApiExplorer, Microsoft.AspNetCore.Mvc.Cors, Microsoft.AspNetCore.Mvc.DataAnnotations, Microsoft.AspNetCore.Mvc.Formatters.Json, Microsoft.AspNetCore.Mvc.Formatters.Xml, Microsoft.AspNetCore.Mvc.Localization, Microsoft.AspNetCore.Mvc.Razor.Host, Microsoft.AspNetCore.Mvc.Razor, Microsoft.AspNetCore.Mvc.TagHelpers, Microsoft.AspNetCore.Mvc.ViewFeatures, Microsoft.AspNetCore.Mvc.WebApiCompatShim
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Weaknesses
CWE-20
Reviewed
2020-06-16

Affected packages

• NuGet Microsoft.AspNetCore.Mvc: >= 1.0.0, < 1.0.4 → fixed in 1.0.4 • NuGet Microsoft.AspNetCore.Mvc: >= 1.1.0, < 1.1.3 → fixed in 1.1.3 • NuGet Microsoft.AspNetCore.Mvc.Core: >= 1.0.0, < 1.0.4 → fixed in 1.0.4 • NuGet Microsoft.AspNetCore.Mvc.Core: >= 1.1.0, < 1.1.3 → fixed in 1.1.3 • NuGet System.Net.Http: >= 4.1.1, < 4.1.2 → fixed in 4.1.2 • NuGet System.Net.Http: >= 4.3.1, < 4.3.2 → fixed in 4.3.2 • NuGet System.Text.Encodings.Web: >= 4.0.0, < 4.0.1 → fixed in 4.0.1 • NuGet System.Text.Encodings.Web: >= 4.3.0, < 4.3.1 → fixed in 4.3.1 • NuGet System.Net.Http.WinHttpHandler: >= 4.0.0, < 4.0.1 → fixed in 4.0.1 • NuGet System.Net.Http.WinHttpHandler: >= 4.3.0, < 4.3.1 → fixed in 4.3.1 • NuGet System.Net.Security: >= 4.0.0, < 4.0.1 → fixed in 4.0.1 • NuGet System.Net.Security: >= 4.3.0, < 4.3.1 → fixed in 4.3.1 • NuGet System.Net.WebSockets.Client: >= 4.0.0, < 4.0.1 → fixed in 4.0.1 • NuGet System.Net.WebSockets.Client: >= 4.3.0, < 4.3.1 → fixed in 4.3.1 • NuGet Microsoft.AspNetCore.Mvc.Abstractions: >= 1.0.0, < 1.0.4 → fixed in 1.0.4 • NuGet Microsoft.AspNetCore.Mvc.Abstractions: >= 1.1.0, < 1.1.3 → fixed in 1.1.3 • NuGet Microsoft.AspNetCore.Mvc.ApiExplorer: >= 1.0.0, < 1.0.4 → fixed in 1.0.4 • NuGet Microsoft.AspNetCore.Mvc.ApiExplorer: >= 1.1.0, < 1.1.3 → fixed in 1.1.3 • NuGet Microsoft.AspNetCore.Mvc.Cors: >= 1.0.0, < 1.0.4 → fixed in 1.0.4 • NuGet Microsoft.AspNetCore.Mvc.Cors: >= 1.1.0, < 1.1.3 → fixed in 1.1.3 • NuGet Microsoft.AspNetCore.Mvc.DataAnnotations: >= 1.0.0, < 1.0.4 → fixed in 1.0.4 • NuGet Microsoft.AspNetCore.Mvc.DataAnnotations: >= 1.1.0, < 1.1.3 → fixed in 1.1.3 • NuGet Microsoft.AspNetCore.Mvc.Formatters.Json: >= 1.0.0, < 1.0.4 → fixed in 1.0.4 • NuGet Microsoft.AspNetCore.Mvc.Formatters.Json: >= 1.1.0, < 1.1.3 → fixed in 1.1.3 • NuGet Microsoft.AspNetCore.Mvc.Formatters.Xml: >= 1.0.0, < 1.0.4 → fixed in 1.0.4 • NuGet Microsoft.AspNetCore.Mvc.Formatters.Xml: >= 1.1.0, < 1.1.3 → fixed in 1.1.3 • NuGet Microsoft.AspNetCore.Mvc.Localization: >= 1.0.0, < 1.0.4 → fixed in 1.0.4 • NuGet Microsoft.AspNetCore.Mvc.Localization: >= 1.1.0, < 1.1.3 → fixed in 1.1.3 • NuGet Microsoft.AspNetCore.Mvc.Razor.Host: >= 1.0.0, < 1.0.4 → fixed in 1.0.4 • NuGet Microsoft.AspNetCore.Mvc.Razor.Host: >= 1.1.0, < 1.1.3 → fixed in 1.1.3 • NuGet Microsoft.AspNetCore.Mvc.Razor: >= 1.0.0, < 1.0.4 → fixed in 1.0.4 • NuGet Microsoft.AspNetCore.Mvc.Razor: >= 1.1.0, < 1.1.3 → fixed in 1.1.3 • NuGet Microsoft.AspNetCore.Mvc.TagHelpers: >= 1.0.0, < 1.0.4 → fixed in 1.0.4 • NuGet Microsoft.AspNetCore.Mvc.TagHelpers: >= 1.1.0, < 1.1.3 → fixed in 1.1.3 • NuGet Microsoft.AspNetCore.Mvc.ViewFeatures: >= 1.0.0, < 1.0.4 → fixed in 1.0.4 • NuGet Microsoft.AspNetCore.Mvc.ViewFeatures: >= 1.1.0, < 1.1.3 → fixed in 1.1.3 • NuGet Microsoft.AspNetCore.Mvc.WebApiCompatShim: >= 1.0.0, < 1.0.4 → fixed in 1.0.4 • NuGet Microsoft.AspNetCore.Mvc.WebApiCompatShim: >= 1.1.0, < 1.1.3 → fixed in 1.1.3

Description

A spoofing vulnerability exists when the ASP.NET Core fails to properly sanitize web requests.

Related

Alias · CVE (1)

  • CVE-2017-0256 A spoofing vulnerability exists when the ASP.NET Core fails to properly sanitize web requests. vulnerability

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References