CVE-2017-0249

An elevation of privilege vulnerability exists when the ASP.NET Core fails to properly sanitize web requests.

Score

CVSS 3.0 7.3 High

Status

Modified - secure@microsoft.com

Published

2017-05-12

Last modified

2024-08-05

Weaknesses

CWE-20

Affected products

• Asp.net Model View Controller (Microsoft)
• Microsoft.aspnetcore.mvc.abstractions (Microsoft)
• Microsoft.aspnetcore.mvc.apiexplorer (Microsoft)
• Microsoft.aspnetcore.mvc.cors (Microsoft)
• Microsoft.aspnetcore.mvc.dataannotations (Microsoft)
• Microsoft.aspnetcore.mvc.formatters.json (Microsoft)
• Microsoft.aspnetcore.mvc.formatters.xml (Microsoft)
• Microsoft.aspnetcore.mvc.localization (Microsoft)
• Microsoft.aspnetcore.mvc.razor (Microsoft)
• Microsoft.aspnetcore.mvc.razor.host (Microsoft)
• Microsoft.aspnetcore.mvc.taghelpers (Microsoft)
• Microsoft.aspnetcore.mvc.viewfeatures (Microsoft)
• Microsoft.aspnetcore.mvc.webapicompatshim (Microsoft)
• System.net.http (Microsoft)
• System.net.http.winhttphandler (Microsoft)
• System.net.security (Microsoft)
• System.net.websockets.client (Microsoft)
• System.text.encodings.web (Microsoft)
• Asp.net Core (Microsoft Corporation)

References

• https://github.com/aspnet/Announcements/issues/239