CVE-2017-8700

High · 7.5

CVSS

7.5

EPSS

10.5%

Published

Nov 15, 2017

CISA due date

—

The record

ASP.NET Core 1.0, 1.1, and 2.0 allow an attacker to bypass Cross-origin Resource Sharing (CORS) configurations and retrieve normally restricted content from a web application, aka "ASP.NET Core Information Disclosure Vulnerability".

Affected packages

Ecosystem	Package	Introduced	Fixed
NuGet	Microsoft.AspNetCore.Mvc.Core	1.0.0	1.0.6
NuGet	Microsoft.AspNetCore.Mvc.Core	1.1.0	1.1.6
NuGet	Microsoft.AspNetCore.Mvc.Cors	1.0.0	1.0.6
NuGet	Microsoft.AspNetCore.Mvc.Cors	1.1.0	1.1.6
nuget	Microsoft.AspNetCore.All	1.0	No fix
nuget	Microsoft.AspNetCore.All	2.0	No fix
nuget	Microsoft.AspNetCore.Mvc.Core	1.0.0	1.0.6
nuget	Microsoft.AspNetCore.Mvc.Core	1.1.0	1.1.6
nuget	Microsoft.AspNetCore.Mvc.Cors	1.0.0	1.0.6
nuget	Microsoft.AspNetCore.Mvc.Cors	1.1.0	1.1.6

Related vulnerabilities

CVE-2017-0247 A denial of service vulnerability exists when the ASP.NET Core fails to properly validate… Also affects Microsoft.AspNetCore.Mvc.Core
CVE-2018-8269 A denial of service vulnerability exists when OData Library improperly handles web… Also affects Microsoft.AspNetCore.All