CVE-2018-0787

Опубликовано: 14 мар. 2018

Источник: nvd

CVSS3: 8.8

CVSS2: 6.8

EPSS Низкий

Описание

ASP.NET Core 1.0. 1.1, and 2.0 allow an elevation of privilege vulnerability due to how web applications that are created from templates validate web requests, aka "ASP.NET Core Elevation Of Privilege Vulnerability".

Ссылки

http://www.securityfocus.com/bid/103282
Third Party Advisory
VDB Entry
http://www.securitytracker.com/id/1040525
Third Party Advisory
VDB Entry
https://github.com/aspnet/Announcements/issues/295
Technical Description
Third Party Advisory
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0787
Patch
Vendor Advisory
http://www.securityfocus.com/bid/103282
Third Party Advisory
VDB Entry
http://www.securitytracker.com/id/1040525
Third Party Advisory
VDB Entry
https://github.com/aspnet/Announcements/issues/295
Technical Description
Third Party Advisory
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0787
Patch
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:microsoft:asp.net_core:1.0:*:*:*:*:*:*:*

cpe:2.3:a:microsoft:asp.net_core:1.1:*:*:*:*:*:*:*

cpe:2.3:a:microsoft:asp.net_core:2.0:*:*:*:*:*:*:*

EPSS

Процентиль: 92%

0.08682

Низкий

8.8 High

CVSS3

6.8 Medium

CVSS2

Дефекты

CWE-640

Связанные уязвимости

CVE-2018-0787

msrc

больше 7 лет назад

ASP.NET Core Elevation of Privilege Vulnerability

GHSA-365p-96qv-xr7g