CVE-2017-0249 High severity vulnerability that affects Microsoft.AspNetCore.Mvc
HighCVSS 7.3
EPSS 4.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
An elevation of privilege vulnerability exists when the ASP.NET Core fails to properly sanitize web requests.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| nuget Microsoft.AspNetCore.Mvc(NuGet) | >= 1.1.0, < 1.1.3 | 1.1.3 |
| nuget Microsoft.AspNetCore.Mvc(NuGet) | >= 1.0.0, < 1.0.4 | 1.0.4 |
| nuget Microsoft.AspNetCore.Mvc.Core(NuGet) | >= 1.0.0, < 1.0.4 | 1.0.4 |
| nuget Microsoft.AspNetCore.Mvc.Core(NuGet) | >= 1.1.0, < 1.1.3 | 1.1.3 |
| nuget System.Net.Http(NuGet) | = 4.1.1 | No fix listed |
| nuget System.Net.Http(NuGet) | = 4.3.1 | No fix listed |
| nuget System.Text.Encodings.Web(NuGet) | = 4.0.0 | No fix listed |
| nuget System.Text.Encodings.Web(NuGet) | = 4.3.0 | No fix listed |
| nuget System.Net.Http.WinHttpHandler(NuGet) | = 4.0.0 | No fix listed |
| nuget System.Net.Http.WinHttpHandler(NuGet) | = 4.3.0 | No fix listed |
| nuget System.Net.Security(NuGet) | = 4.0.0 | No fix listed |
| nuget System.Net.Security(NuGet) | = 4.3.0 | No fix listed |
| nuget System.Net.WebSockets.Client(NuGet) | = 4.0.0 | No fix listed |
| nuget System.Net.WebSockets.Client(NuGet) | = 4.3.0 | No fix listed |
| nuget Microsoft.AspNetCore.Mvc.Abstractions(NuGet) | >= 1.0.0, < 1.0.4 | 1.0.4 |
| nuget Microsoft.AspNetCore.Mvc.Abstractions(NuGet) | >= 1.1.0, < 1.1.3 | 1.1.3 |
| nuget Microsoft.AspNetCore.Mvc.ApiExplorer(NuGet) | >= 1.0.0, < 1.0.4 | 1.0.4 |
| nuget Microsoft.AspNetCore.Mvc.ApiExplorer(NuGet) | >= 1.1.0, < 1.1.3 | 1.1.3 |
| nuget Microsoft.AspNetCore.Mvc.Cors(NuGet) | >= 1.0.0, < 1.0.4 | 1.0.4 |
| nuget Microsoft.AspNetCore.Mvc.Cors(NuGet) | >= 1.1.0, < 1.1.3 | 1.1.3 |
| nuget Microsoft.AspNetCore.Mvc.DataAnnotations(NuGet) | >= 1.0.0, < 1.0.4 | 1.0.4 |
| nuget Microsoft.AspNetCore.Mvc.DataAnnotations(NuGet) | >= 1.1.0, < 1.1.3 | 1.1.3 |
| nuget Microsoft.AspNetCore.Mvc.Formatters.Json(NuGet) | >= 1.0.0, < 1.0.4 | 1.0.4 |
| nuget Microsoft.AspNetCore.Mvc.Formatters.Json(NuGet) | >= 1.1.0, < 1.1.3 | 1.1.3 |
| nuget Microsoft.AspNetCore.Mvc.Formatters.Xml(NuGet) | >= 1.0.0, < 1.0.4 | 1.0.4 |
Show 175 more
| Product | Affected versions | Fixed in |
|---|---|---|
| nuget Microsoft.AspNetCore.Mvc.Formatters.Xml(NuGet) | >= 1.1.0, < 1.1.3 | 1.1.3 |
| nuget Microsoft.AspNetCore.Mvc.Localization(NuGet) | >= 1.0.0, < 1.0.4 | 1.0.4 |
| nuget Microsoft.AspNetCore.Mvc.Localization(NuGet) | >= 1.1.0, < 1.1.3 | 1.1.3 |
| nuget Microsoft.AspNetCore.Mvc.Razor.Host(NuGet) | >= 1.0.0, < 1.0.4 | 1.0.4 |
| nuget Microsoft.AspNetCore.Mvc.Razor.Host(NuGet) | >= 1.1.0, < 1.1.3 | 1.1.3 |
| nuget Microsoft.AspNetCore.Mvc.Razor(NuGet) | >= 1.0.0, < 1.0.4 | 1.0.4 |
| nuget Microsoft.AspNetCore.Mvc.Razor(NuGet) | >= 1.1.0, < 1.1.3 | 1.1.3 |
| nuget Microsoft.AspNetCore.Mvc.TagHelpers(NuGet) | >= 1.0.0, < 1.0.4 | 1.0.4 |
| nuget Microsoft.AspNetCore.Mvc.TagHelpers(NuGet) | >= 1.1.0, < 1.1.3 | 1.1.3 |
| nuget Microsoft.AspNetCore.Mvc.ViewFeatures(NuGet) | >= 1.0.0, < 1.0.4 | 1.0.4 |
| nuget Microsoft.AspNetCore.Mvc.ViewFeatures(NuGet) | >= 1.1.0, < 1.1.3 | 1.1.3 |
| nuget Microsoft.AspNetCore.Mvc.WebApiCompatShim(NuGet) | >= 1.0.0, < 1.0.4 | 1.0.4 |
| nuget Microsoft.AspNetCore.Mvc.WebApiCompatShim(NuGet) | >= 1.1.0, < 1.1.3 | 1.1.3 |
| nuget DisCatSharp(NuGet) | <= 9.8.3 | No fix listed |
| nuget Microsoft.AspNetCore.Mvc(NuGet) | = 1.0.0 | No fix listed |
| nuget Microsoft.AspNetCore.Mvc(NuGet) | = 1.0.1 | No fix listed |
| nuget Microsoft.AspNetCore.Mvc(NuGet) | = 1.0.2 | No fix listed |
| nuget Microsoft.AspNetCore.Mvc(NuGet) | = 1.0.3 | No fix listed |
| nuget Microsoft.AspNetCore.Mvc(NuGet) | = 1.1.0 | No fix listed |
| nuget Microsoft.AspNetCore.Mvc(NuGet) | = 1.1.1 | No fix listed |
| nuget Microsoft.AspNetCore.Mvc(NuGet) | = 1.1.2 | No fix listed |
| nuget Microsoft.AspNetCore.Mvc.Core(NuGet) | = 1.0.0 | No fix listed |
| nuget Microsoft.AspNetCore.Mvc.Core(NuGet) | = 1.0.1 | No fix listed |
| nuget Microsoft.AspNetCore.Mvc.Core(NuGet) | = 1.0.2 | No fix listed |
| nuget Microsoft.AspNetCore.Mvc.Core(NuGet) | = 1.0.3 | No fix listed |
| nuget Microsoft.AspNetCore.Mvc.Core(NuGet) | = 1.1.0 | No fix listed |
| nuget Microsoft.AspNetCore.Mvc.Core(NuGet) | = 1.1.1 | No fix listed |
| nuget Microsoft.AspNetCore.Mvc.Core(NuGet) | = 1.1.2 | No fix listed |
| nuget System.Net.Http(NuGet) | >= 4.1.1, < 4.1.2 | 4.1.2 |
| nuget System.Net.Http(NuGet) | >= 4.3.1, < 4.3.2 | 4.3.2 |
| nuget System.Text.Encodings.Web(NuGet) | >= 4.0.0, < 4.0.1 | 4.0.1 |
| nuget System.Text.Encodings.Web(NuGet) | >= 4.3.0, < 4.3.1 | 4.3.1 |
| nuget System.Net.Http.WinHttpHandler(NuGet) | >= 4.0.0, < 4.0.1 | 4.0.1 |
| nuget System.Net.Http.WinHttpHandler(NuGet) | >= 4.3.0, < 4.3.1 | 4.3.1 |
| nuget System.Net.Security(NuGet) | >= 4.0.0, < 4.0.1 | 4.0.1 |
| nuget System.Net.Security(NuGet) | >= 4.3.0, < 4.3.1 | 4.3.1 |
| nuget System.Net.WebSockets.Client(NuGet) | >= 4.0.0, < 4.0.1 | 4.0.1 |
| nuget System.Net.WebSockets.Client(NuGet) | >= 4.3.0, < 4.3.1 | 4.3.1 |
| nuget Microsoft.AspNetCore.Mvc.Abstractions(NuGet) | = 1.0.0 | No fix listed |
| nuget Microsoft.AspNetCore.Mvc.Abstractions(NuGet) | = 1.0.1 | No fix listed |
| nuget Microsoft.AspNetCore.Mvc.Abstractions(NuGet) | = 1.0.2 | No fix listed |
| nuget Microsoft.AspNetCore.Mvc.Abstractions(NuGet) | = 1.0.3 | No fix listed |
| nuget Microsoft.AspNetCore.Mvc.Abstractions(NuGet) | = 1.1.0 | No fix listed |
| nuget Microsoft.AspNetCore.Mvc.Abstractions(NuGet) | = 1.1.1 | No fix listed |
| nuget Microsoft.AspNetCore.Mvc.Abstractions(NuGet) | = 1.1.2 | No fix listed |
| nuget Microsoft.AspNetCore.Mvc.ApiExplorer(NuGet) | = 1.0.0 | No fix listed |
| nuget Microsoft.AspNetCore.Mvc.ApiExplorer(NuGet) | = 1.0.1 | No fix listed |
| nuget Microsoft.AspNetCore.Mvc.ApiExplorer(NuGet) | = 1.0.2 | No fix listed |
| nuget Microsoft.AspNetCore.Mvc.ApiExplorer(NuGet) | = 1.0.3 | No fix listed |
| nuget Microsoft.AspNetCore.Mvc.ApiExplorer(NuGet) | = 1.1.0 | No fix listed |
| nuget Microsoft.AspNetCore.Mvc.ApiExplorer(NuGet) | = 1.1.1 | No fix listed |
| nuget Microsoft.AspNetCore.Mvc.ApiExplorer(NuGet) | = 1.1.2 | No fix listed |
| nuget Microsoft.AspNetCore.Mvc.Cors(NuGet) | = 1.0.0 | No fix listed |
| nuget Microsoft.AspNetCore.Mvc.Cors(NuGet) | = 1.0.1 | No fix listed |
| nuget Microsoft.AspNetCore.Mvc.Cors(NuGet) | = 1.0.2 | No fix listed |
| nuget Microsoft.AspNetCore.Mvc.Cors(NuGet) | = 1.0.3 | No fix listed |
| nuget Microsoft.AspNetCore.Mvc.Cors(NuGet) | = 1.1.0 | No fix listed |
| nuget Microsoft.AspNetCore.Mvc.Cors(NuGet) | = 1.1.1 | No fix listed |
| nuget Microsoft.AspNetCore.Mvc.Cors(NuGet) | = 1.1.2 | No fix listed |
| nuget Microsoft.AspNetCore.Mvc.DataAnnotations(NuGet) | = 1.0.0 | No fix listed |
| nuget Microsoft.AspNetCore.Mvc.DataAnnotations(NuGet) | = 1.0.1 | No fix listed |
| nuget Microsoft.AspNetCore.Mvc.DataAnnotations(NuGet) | = 1.0.2 | No fix listed |
| nuget Microsoft.AspNetCore.Mvc.DataAnnotations(NuGet) | = 1.0.3 | No fix listed |
| nuget Microsoft.AspNetCore.Mvc.DataAnnotations(NuGet) | = 1.1.0 | No fix listed |
| nuget Microsoft.AspNetCore.Mvc.DataAnnotations(NuGet) | = 1.1.1 | No fix listed |
| nuget Microsoft.AspNetCore.Mvc.DataAnnotations(NuGet) | = 1.1.2 | No fix listed |
| nuget Microsoft.AspNetCore.Mvc.Formatters.Json(NuGet) | = 1.0.0 | No fix listed |
| nuget Microsoft.AspNetCore.Mvc.Formatters.Json(NuGet) | = 1.0.1 | No fix listed |
| nuget Microsoft.AspNetCore.Mvc.Formatters.Json(NuGet) | = 1.0.2 | No fix listed |
| nuget Microsoft.AspNetCore.Mvc.Formatters.Json(NuGet) | = 1.0.3 | No fix listed |
| nuget Microsoft.AspNetCore.Mvc.Formatters.Json(NuGet) | = 1.1.0 | No fix listed |
| nuget Microsoft.AspNetCore.Mvc.Formatters.Json(NuGet) | = 1.1.1 | No fix listed |
| nuget Microsoft.AspNetCore.Mvc.Formatters.Json(NuGet) | = 1.1.2 | No fix listed |
| nuget Microsoft.AspNetCore.Mvc.Formatters.Xml(NuGet) | = 1.0.0 | No fix listed |
| nuget Microsoft.AspNetCore.Mvc.Formatters.Xml(NuGet) | = 1.0.1 | No fix listed |
| nuget Microsoft.AspNetCore.Mvc.Formatters.Xml(NuGet) | = 1.0.2 | No fix listed |
| nuget Microsoft.AspNetCore.Mvc.Formatters.Xml(NuGet) | = 1.0.3 | No fix listed |
| nuget Microsoft.AspNetCore.Mvc.Formatters.Xml(NuGet) | = 1.1.0 | No fix listed |
| nuget Microsoft.AspNetCore.Mvc.Formatters.Xml(NuGet) | = 1.1.1 | No fix listed |
| nuget Microsoft.AspNetCore.Mvc.Formatters.Xml(NuGet) | = 1.1.2 | No fix listed |
| nuget Microsoft.AspNetCore.Mvc.Localization(NuGet) | = 1.0.0 | No fix listed |
| nuget Microsoft.AspNetCore.Mvc.Localization(NuGet) | = 1.0.1 | No fix listed |
| nuget Microsoft.AspNetCore.Mvc.Localization(NuGet) | = 1.0.2 | No fix listed |
| nuget Microsoft.AspNetCore.Mvc.Localization(NuGet) | = 1.0.3 | No fix listed |
| nuget Microsoft.AspNetCore.Mvc.Localization(NuGet) | = 1.1.0 | No fix listed |
| nuget Microsoft.AspNetCore.Mvc.Localization(NuGet) | = 1.1.1 | No fix listed |
| nuget Microsoft.AspNetCore.Mvc.Localization(NuGet) | = 1.1.2 | No fix listed |
| nuget Microsoft.AspNetCore.Mvc.Razor.Host(NuGet) | = 1.0.0 | No fix listed |
| nuget Microsoft.AspNetCore.Mvc.Razor.Host(NuGet) | = 1.0.1 | No fix listed |
| nuget Microsoft.AspNetCore.Mvc.Razor.Host(NuGet) | = 1.0.2 | No fix listed |
| nuget Microsoft.AspNetCore.Mvc.Razor.Host(NuGet) | = 1.0.3 | No fix listed |
| nuget Microsoft.AspNetCore.Mvc.Razor.Host(NuGet) | = 1.1.0 | No fix listed |
| nuget Microsoft.AspNetCore.Mvc.Razor.Host(NuGet) | = 1.1.1 | No fix listed |
| nuget Microsoft.AspNetCore.Mvc.Razor.Host(NuGet) | = 1.1.2 | No fix listed |
| nuget Microsoft.AspNetCore.Mvc.Razor(NuGet) | = 1.0.0 | No fix listed |
| nuget Microsoft.AspNetCore.Mvc.Razor(NuGet) | = 1.0.1 | No fix listed |
| nuget Microsoft.AspNetCore.Mvc.Razor(NuGet) | = 1.0.2 | No fix listed |
| nuget Microsoft.AspNetCore.Mvc.Razor(NuGet) | = 1.0.3 | No fix listed |
| nuget Microsoft.AspNetCore.Mvc.Razor(NuGet) | = 1.1.0 | No fix listed |
| nuget Microsoft.AspNetCore.Mvc.Razor(NuGet) | = 1.1.1 | No fix listed |
| nuget Microsoft.AspNetCore.Mvc.Razor(NuGet) | = 1.1.2 | No fix listed |
| nuget Microsoft.AspNetCore.Mvc.TagHelpers(NuGet) | = 1.0.0 | No fix listed |
| nuget Microsoft.AspNetCore.Mvc.TagHelpers(NuGet) | = 1.0.1 | No fix listed |
| nuget Microsoft.AspNetCore.Mvc.TagHelpers(NuGet) | = 1.0.2 | No fix listed |
| nuget Microsoft.AspNetCore.Mvc.TagHelpers(NuGet) | = 1.0.3 | No fix listed |
| nuget Microsoft.AspNetCore.Mvc.TagHelpers(NuGet) | = 1.1.0 | No fix listed |
| nuget Microsoft.AspNetCore.Mvc.TagHelpers(NuGet) | = 1.1.1 | No fix listed |
| nuget Microsoft.AspNetCore.Mvc.TagHelpers(NuGet) | = 1.1.2 | No fix listed |
| nuget Microsoft.AspNetCore.Mvc.ViewFeatures(NuGet) | = 1.0.0 | No fix listed |
| nuget Microsoft.AspNetCore.Mvc.ViewFeatures(NuGet) | = 1.0.1 | No fix listed |
| nuget Microsoft.AspNetCore.Mvc.ViewFeatures(NuGet) | = 1.0.2 | No fix listed |
| nuget Microsoft.AspNetCore.Mvc.ViewFeatures(NuGet) | = 1.0.3 | No fix listed |
| nuget Microsoft.AspNetCore.Mvc.ViewFeatures(NuGet) | = 1.1.0 | No fix listed |
| nuget Microsoft.AspNetCore.Mvc.ViewFeatures(NuGet) | = 1.1.1 | No fix listed |
| nuget Microsoft.AspNetCore.Mvc.ViewFeatures(NuGet) | = 1.1.2 | No fix listed |
| nuget Microsoft.AspNetCore.Mvc.WebApiCompatShim(NuGet) | = 1.0.0 | No fix listed |
| nuget Microsoft.AspNetCore.Mvc.WebApiCompatShim(NuGet) | = 1.0.1 | No fix listed |
| nuget Microsoft.AspNetCore.Mvc.WebApiCompatShim(NuGet) | = 1.0.2 | No fix listed |
| nuget Microsoft.AspNetCore.Mvc.WebApiCompatShim(NuGet) | = 1.0.3 | No fix listed |
| nuget Microsoft.AspNetCore.Mvc.WebApiCompatShim(NuGet) | = 1.1.0 | No fix listed |
| nuget Microsoft.AspNetCore.Mvc.WebApiCompatShim(NuGet) | = 1.1.1 | No fix listed |
| nuget Microsoft.AspNetCore.Mvc.WebApiCompatShim(NuGet) | = 1.1.2 | No fix listed |
| nuget DisCatSharp(NuGet) | = 9.5.8 | No fix listed |
| nuget DisCatSharp(NuGet) | = 9.5.8-nightly-00003 | No fix listed |
| nuget DisCatSharp(NuGet) | = 9.5.8-nightly-00004 | No fix listed |
| nuget DisCatSharp(NuGet) | = 9.5.8-nightly-00183 | No fix listed |
| nuget DisCatSharp(NuGet) | = 9.5.8-nightly-00184 | No fix listed |
| nuget DisCatSharp(NuGet) | = 9.6.0 | No fix listed |
| nuget DisCatSharp(NuGet) | = 9.6.0-nightly-00005 | No fix listed |
| nuget DisCatSharp(NuGet) | = 9.6.0-nightly-00008 | No fix listed |
| nuget DisCatSharp(NuGet) | = 9.6.0-nightly-00010 | No fix listed |
| nuget DisCatSharp(NuGet) | = 9.6.0-nightly-00011 | No fix listed |
| nuget DisCatSharp(NuGet) | = 9.6.1 | No fix listed |
| nuget DisCatSharp(NuGet) | = 9.6.1-nightly-00012 | No fix listed |
| nuget DisCatSharp(NuGet) | = 9.6.1-nightly-00015 | No fix listed |
| nuget DisCatSharp(NuGet) | = 9.6.1-nightly-00016 | No fix listed |
| nuget DisCatSharp(NuGet) | = 9.6.1-nightly-00017 | No fix listed |
| nuget DisCatSharp(NuGet) | = 9.6.1-nightly-00018 | No fix listed |
| nuget DisCatSharp(NuGet) | = 9.6.2 | No fix listed |
| nuget DisCatSharp(NuGet) | = 9.6.2-nightly-00019 | No fix listed |
| nuget DisCatSharp(NuGet) | = 9.6.2-nightly-00020 | No fix listed |
| nuget DisCatSharp(NuGet) | = 9.6.2-nightly-00022 | No fix listed |
| nuget DisCatSharp(NuGet) | = 9.6.2-nightly-00023 | No fix listed |
| nuget DisCatSharp(NuGet) | = 9.6.2-nightly-00025 | No fix listed |
| nuget DisCatSharp(NuGet) | = 9.6.2-nightly-00026 | No fix listed |
| nuget DisCatSharp(NuGet) | = 9.6.2-nightly-00027 | No fix listed |
| nuget DisCatSharp(NuGet) | = 9.6.2-nightly-00028 | No fix listed |
| nuget DisCatSharp(NuGet) | = 9.6.2-nightly-00029 | No fix listed |
| nuget DisCatSharp(NuGet) | = 9.6.2-nightly-00030 | No fix listed |
| nuget DisCatSharp(NuGet) | = 9.6.3-nightly-00034 | No fix listed |
| nuget DisCatSharp(NuGet) | = 9.6.3-nightly-00035 | No fix listed |
| nuget DisCatSharp(NuGet) | = 9.6.3-nightly-00036 | No fix listed |
| nuget DisCatSharp(NuGet) | = 9.6.3-nightly-00037 | No fix listed |
| nuget DisCatSharp(NuGet) | = 9.6.3-nightly-00038 | No fix listed |
| nuget DisCatSharp(NuGet) | = 9.6.3-nightly-00039 | No fix listed |
| nuget DisCatSharp(NuGet) | = 9.6.3-nightly-00041 | No fix listed |
| nuget DisCatSharp(NuGet) | = 9.6.3-nightly-00042 | No fix listed |
| nuget DisCatSharp(NuGet) | = 9.6.3-nightly-00043 | No fix listed |
| nuget DisCatSharp(NuGet) | = 9.6.3-nightly-00044 | No fix listed |
| nuget DisCatSharp(NuGet) | = 9.6.3-nightly-00045 | No fix listed |
| nuget DisCatSharp(NuGet) | = 9.6.3-nightly-00046 | No fix listed |
| nuget DisCatSharp(NuGet) | = 9.6.3-nightly-00047 | No fix listed |
| nuget DisCatSharp(NuGet) | = 9.6.3-nightly-00048 | No fix listed |
| nuget DisCatSharp(NuGet) | = 9.6.3-nightly-00049 | No fix listed |
| nuget DisCatSharp(NuGet) | = 9.6.3-nightly-00050 | No fix listed |
| nuget DisCatSharp(NuGet) | = 9.6.3-nightly-00051 | No fix listed |
| nuget DisCatSharp(NuGet) | = 9.7.0 | No fix listed |
| nuget DisCatSharp(NuGet) | = 9.7.0-nightly-00054 | No fix listed |
| nuget DisCatSharp(NuGet) | = 9.7.0-nightly-00055 | No fix listed |
| nuget DisCatSharp(NuGet) | = 9.7.0-nightly-00056 | No fix listed |
| nuget DisCatSharp(NuGet) | = 9.7.0-nightly-00057 | No fix listed |
| nuget DisCatSharp(NuGet) | = 9.7.0-nightly-00058 | No fix listed |
| nuget DisCatSharp(NuGet) | = 9.7.0-nightly-00059 | No fix listed |
| nuget DisCatSharp(NuGet) | = 9.8.0 | No fix listed |
| nuget DisCatSharp(NuGet) | = 9.8.0-nightly-00062 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com technical-description third-party-advisory
- github.com vendor-advisory
- github.com vendor-advisory