Skip to content
OpenAdvisories
Medium · 6.1 CVE-2019-1075 EUVD-2022-4821GHSA-prrf-397v-83xh

Open redirect in ASP.NET Core

Published Jul 15, 2019 · Updated Aug 4, 2024 · Assigned by microsoft

Vendor: Microsoft Product: ASP.NET Core Package: Microsoft.AspNetCore.All Package: Microsoft.AspNetCore.App Package: Microsoft.AspNetCore.Server.HttpSys Package: Microsoft.AspNetCore.Server.IIS Ecosystem: NuGet

Description

A spoofing vulnerability exists in ASP.NET Core that could lead to an open redirect, aka 'ASP.NET Core Spoofing Vulnerability'.

Affected products

VendorProductAffectedFixed
Microsoft ASP.NET Core 2.1, 2.2 —

Affected packages

EcosystemPackageAffectedFixedRecord
NuGet Microsoft.AspNetCore.All >= 2.2.0, < 2.2.6 2.2.6 GHSA-prrf-397v-83xh
NuGet Microsoft.AspNetCore.All >= 2.1.0, < 2.1.12 2.1.12 GHSA-prrf-397v-83xh
NuGet Microsoft.AspNetCore.App >= 2.2.0, < 2.2.6 2.2.6 GHSA-prrf-397v-83xh
NuGet Microsoft.AspNetCore.App >= 2.1.0, < 2.1.12 2.1.12 GHSA-prrf-397v-83xh
NuGet Microsoft.AspNetCore.Server.HttpSys >= 2.2.0, < 2.2.6 2.2.6 GHSA-prrf-397v-83xh
NuGet Microsoft.AspNetCore.Server.HttpSys >= 2.1.0, < 2.1.12 2.1.12 GHSA-prrf-397v-83xh
NuGet Microsoft.AspNetCore.Server.IIS >= 2.2.0, < 2.2.6 2.2.6 GHSA-prrf-397v-83xh

References