Ecosyste.ms: Advisories

An open API service providing security vulnerability metadata for many open source software ecosystems.

Security Advisories: GSA_kwCzR0hTQS0zcnA2LXJqdzQtY3EzOc4AASeG

Cross-origin Resource Sharing bypass in ASP.NET Core

ASP.NET Core 1.0, 1.1, and 2.0 allow an attacker to bypass Cross-origin Resource Sharing (CORS) configurations and retrieve normally restricted content from a web application, aka "ASP.NET Core Information Disclosure Vulnerability".

Permalink: https://github.com/advisories/GHSA-3rp6-rjw4-cq39
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS0zcnA2LXJqdzQtY3EzOc4AASeG
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: over 2 years ago
Updated: almost 2 years ago


CVSS Score: 7.5
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS Percentage: 0.00928
EPSS Percentile: 0.83503

Identifiers: GHSA-3rp6-rjw4-cq39, CVE-2017-8700
References: Repository: https://github.com/github/advisory-database
Blast Radius: 1.0

Affected Packages

nuget:Microsoft.AspNetCore.Mvc.Cors
Dependent packages: 34
Dependent repositories: 0
Downloads: 230,613,766 total
Affected Version Ranges: >= 1.1.0, < 1.1.6, >= 1.0.0, < 1.0.6
Fixed in: 1.1.6, 1.0.6
All affected versions: 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.0.5, 1.1.0, 1.1.1, 1.1.2, 1.1.3, 1.1.4, 1.1.5
All unaffected versions: 1.0.6, 1.1.6, 1.1.7, 1.1.8, 2.0.0, 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.1.0, 2.1.1, 2.1.2, 2.1.3, 2.2.0
nuget:Microsoft.AspNetCore.Mvc.Core
Dependent packages: 2,433
Dependent repositories: 0
Downloads: 758,852,912 total
Affected Version Ranges: >= 1.1.0, < 1.1.6, >= 1.0.0, < 1.0.6
Fixed in: 1.1.6, 1.0.6
All affected versions: 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.0.5, 1.1.0, 1.1.1, 1.1.2, 1.1.3, 1.1.4, 1.1.5
All unaffected versions: 1.0.6, 1.1.6, 1.1.7, 1.1.8, 2.0.0, 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.1.0, 2.1.1, 2.1.2, 2.1.3, 2.1.11, 2.1.16, 2.1.34, 2.1.38, 2.2.0, 2.2.2, 2.2.5