Description
ASP.NET Core 2.0 allows an attacker to steal log-in session information such as cookies or authentication tokens via a specially crafted URL aka "ASP.NET Core Elevation Of Privilege Vulnerability".
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Microsoft | ASP.NET Core | ASP.NET Core 2.0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| NuGet | Microsoft.AspNetCore.All | >= 2.0.0, < 2.0.3 | 2.0.3 | GHSA-3wcj-rg8q-9cqv |
| NuGet | Microsoft.AspNetCore.Mvc.Core | >= 2.0.0, < 2.0.1 | 2.0.1 | GHSA-3wcj-rg8q-9cqv |