Description
ASP.NET Core 1.0, 1.1, and 2.0 allow an attacker to bypass Cross-origin Resource Sharing (CORS) configurations and retrieve normally restricted content from a web application, aka "ASP.NET Core Information Disclosure Vulnerability".
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Microsoft | ASP.NET Core | ASP.NET Core 1.0, 1.1, and 2.0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| NuGet | Microsoft.AspNetCore.Mvc.Core | >= 1.0.0, < 1.0.6 | 1.0.6 | GHSA-3rp6-rjw4-cq39 |
| NuGet | Microsoft.AspNetCore.Mvc.Core | >= 1.1.0, < 1.1.6 | 1.1.6 | GHSA-3rp6-rjw4-cq39 |
| NuGet | Microsoft.AspNetCore.Mvc.Cors | >= 1.0.0, < 1.0.6 | 1.0.6 | GHSA-3rp6-rjw4-cq39 |
| NuGet | Microsoft.AspNetCore.Mvc.Cors | >= 1.1.0, < 1.1.6 | 1.1.6 | GHSA-3rp6-rjw4-cq39 |