Skip to content
OpenAdvisories
High · 7.3 CVE-2017-0249 EUVD-2018-0665GHSA-qhqf-ghgh-x2m4

High severity vulnerability that affects Microsoft.AspNetCore.Mvc

Published May 12, 2017 · Updated Aug 5, 2024 · Assigned by microsoft

Vendor: Microsoft Product: ASP.NET Core Package: DisCatSharp Package: Microsoft.AspNetCore.Mvc Package: Microsoft.AspNetCore.Mvc.Abstractions Package: Microsoft.AspNetCore.Mvc.ApiExplorer Package: Microsoft.AspNetCore.Mvc.Core Package: Microsoft.AspNetCore.Mvc.Cors Package: Microsoft.AspNetCore.Mvc.DataAnnotations Package: Microsoft.AspNetCore.Mvc.Formatters.Json Package: Microsoft.AspNetCore.Mvc.Formatters.Xml Package: Microsoft.AspNetCore.Mvc.Localization Package: Microsoft.AspNetCore.Mvc.Razor Package: Microsoft.AspNetCore.Mvc.Razor.Host Package: Microsoft.AspNetCore.Mvc.TagHelpers Package: Microsoft.AspNetCore.Mvc.ViewFeatures Package: Microsoft.AspNetCore.Mvc.WebApiCompatShim Package: System.Net.Http Package: System.Net.Http.WinHttpHandler Package: System.Net.Security Package: System.Net.WebSockets.Client Package: System.Text.Encodings.Web Ecosystem: NuGet

Description

An elevation of privilege vulnerability exists when the ASP.NET Core fails to properly sanitize web requests.

Affected products

VendorProductAffectedFixed
Microsoft ASP.NET Core ASP.NET Core —

Affected packages

EcosystemPackageAffectedFixedRecord
NuGet DisCatSharp <= 9.8.3 — GHSA-qhqf-ghgh-x2m4
NuGet Microsoft.AspNetCore.Mvc >= 1.0.0, < 1.0.4 1.0.4 GHSA-qhqf-ghgh-x2m4
NuGet Microsoft.AspNetCore.Mvc >= 1.1.0, < 1.1.3 1.1.3 GHSA-qhqf-ghgh-x2m4
NuGet Microsoft.AspNetCore.Mvc.Abstractions >= 1.0.0, < 1.0.4 1.0.4 GHSA-qhqf-ghgh-x2m4
NuGet Microsoft.AspNetCore.Mvc.Abstractions >= 1.1.0, < 1.1.3 1.1.3 GHSA-qhqf-ghgh-x2m4
NuGet Microsoft.AspNetCore.Mvc.ApiExplorer >= 1.0.0, < 1.0.4 1.0.4 GHSA-qhqf-ghgh-x2m4
NuGet Microsoft.AspNetCore.Mvc.ApiExplorer >= 1.1.0, < 1.1.3 1.1.3 GHSA-qhqf-ghgh-x2m4
NuGet Microsoft.AspNetCore.Mvc.Core >= 1.0.0, < 1.0.4 1.0.4 GHSA-qhqf-ghgh-x2m4
NuGet Microsoft.AspNetCore.Mvc.Core >= 1.1.0, < 1.1.3 1.1.3 GHSA-qhqf-ghgh-x2m4
NuGet Microsoft.AspNetCore.Mvc.Cors >= 1.0.0, < 1.0.4 1.0.4 GHSA-qhqf-ghgh-x2m4
NuGet Microsoft.AspNetCore.Mvc.Cors >= 1.1.0, < 1.1.3 1.1.3 GHSA-qhqf-ghgh-x2m4
NuGet Microsoft.AspNetCore.Mvc.DataAnnotations >= 1.0.0, < 1.0.4 1.0.4 GHSA-qhqf-ghgh-x2m4
NuGet Microsoft.AspNetCore.Mvc.DataAnnotations >= 1.1.0, < 1.1.3 1.1.3 GHSA-qhqf-ghgh-x2m4
NuGet Microsoft.AspNetCore.Mvc.Formatters.Json >= 1.0.0, < 1.0.4 1.0.4 GHSA-qhqf-ghgh-x2m4
NuGet Microsoft.AspNetCore.Mvc.Formatters.Json >= 1.1.0, < 1.1.3 1.1.3 GHSA-qhqf-ghgh-x2m4
NuGet Microsoft.AspNetCore.Mvc.Formatters.Xml >= 1.0.0, < 1.0.4 1.0.4 GHSA-qhqf-ghgh-x2m4
NuGet Microsoft.AspNetCore.Mvc.Formatters.Xml >= 1.1.0, < 1.1.3 1.1.3 GHSA-qhqf-ghgh-x2m4
NuGet Microsoft.AspNetCore.Mvc.Localization >= 1.0.0, < 1.0.4 1.0.4 GHSA-qhqf-ghgh-x2m4
NuGet Microsoft.AspNetCore.Mvc.Localization >= 1.1.0, < 1.1.3 1.1.3 GHSA-qhqf-ghgh-x2m4
NuGet Microsoft.AspNetCore.Mvc.Razor >= 1.0.0, < 1.0.4 1.0.4 GHSA-qhqf-ghgh-x2m4
NuGet Microsoft.AspNetCore.Mvc.Razor >= 1.1.0, < 1.1.3 1.1.3 GHSA-qhqf-ghgh-x2m4
NuGet Microsoft.AspNetCore.Mvc.Razor.Host >= 1.0.0, < 1.0.4 1.0.4 GHSA-qhqf-ghgh-x2m4
NuGet Microsoft.AspNetCore.Mvc.Razor.Host >= 1.1.0, < 1.1.3 1.1.3 GHSA-qhqf-ghgh-x2m4
NuGet Microsoft.AspNetCore.Mvc.TagHelpers >= 1.0.0, < 1.0.4 1.0.4 GHSA-qhqf-ghgh-x2m4
NuGet Microsoft.AspNetCore.Mvc.TagHelpers >= 1.1.0, < 1.1.3 1.1.3 GHSA-qhqf-ghgh-x2m4
NuGet Microsoft.AspNetCore.Mvc.ViewFeatures >= 1.0.0, < 1.0.4 1.0.4 GHSA-qhqf-ghgh-x2m4
NuGet Microsoft.AspNetCore.Mvc.ViewFeatures >= 1.1.0, < 1.1.3 1.1.3 GHSA-qhqf-ghgh-x2m4
NuGet Microsoft.AspNetCore.Mvc.WebApiCompatShim >= 1.0.0, < 1.0.4 1.0.4 GHSA-qhqf-ghgh-x2m4
NuGet Microsoft.AspNetCore.Mvc.WebApiCompatShim >= 1.1.0, < 1.1.3 1.1.3 GHSA-qhqf-ghgh-x2m4
NuGet System.Net.Http >= 4.1.1, < 4.1.2 4.1.2 GHSA-qhqf-ghgh-x2m4
NuGet System.Net.Http >= 4.3.1, < 4.3.2 4.3.2 GHSA-qhqf-ghgh-x2m4
NuGet System.Net.Http.WinHttpHandler >= 4.0.0, < 4.0.1 4.0.1 GHSA-qhqf-ghgh-x2m4
NuGet System.Net.Http.WinHttpHandler >= 4.3.0, < 4.3.1 4.3.1 GHSA-qhqf-ghgh-x2m4
NuGet System.Net.Security >= 4.0.0, < 4.0.1 4.0.1 GHSA-qhqf-ghgh-x2m4
NuGet System.Net.Security >= 4.3.0, < 4.3.1 4.3.1 GHSA-qhqf-ghgh-x2m4
NuGet System.Net.WebSockets.Client >= 4.0.0, < 4.0.1 4.0.1 GHSA-qhqf-ghgh-x2m4
NuGet System.Net.WebSockets.Client >= 4.3.0, < 4.3.1 4.3.1 GHSA-qhqf-ghgh-x2m4
NuGet System.Text.Encodings.Web >= 4.0.0, < 4.0.1 4.0.1 GHSA-qhqf-ghgh-x2m4
NuGet System.Text.Encodings.Web >= 4.3.0, < 4.3.1 4.3.1 GHSA-qhqf-ghgh-x2m4

References