Fluid Attacks Database

Description

Open redirect in ASP.NET Core ASP.NET Core 2.0 allows an attacker to steal log-in session information such as cookies or authentication tokens via a specially crafted URL aka "ASP.NET Core Elevation Of Privilege Vulnerability".

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
nuget	microsoft.aspnetcore.all	>=2.0.0 <2.0.3	2.0.3
nuget	microsoft.aspnetcore.mvc.core	=2.0.0 \|\| >=2.0.0 <2.0.1	2.0.1

Aliases

1. CVE-2017-118792. NVD-2017-118793. OSV-2017-118794. GCVE-2017-11879

References

1. https://github.com/aspnet/Announcements/issues/2772. https://github.com/github/advisory-database/issues/3023. https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11879

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.