Vulnerability Description
A spoofing vulnerability exists when the ASP.NET Core fails to properly sanitize web requests.
CVSS Score
5.3
MEDIUM
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Microsoft | Asp.Net Model View Controller | 1.0.0 |
| Microsoft | Microsoft.Aspnetcore.Mvc.Abstractions | 1.0.0 |
| Microsoft | Microsoft.Aspnetcore.Mvc.Apiexplorer | 1.0.0 |
| Microsoft | Microsoft.Aspnetcore.Mvc.Cors | 1.0.0 |
| Microsoft | Microsoft.Aspnetcore.Mvc.Dataannotations | 1.0.0 |
| Microsoft | Microsoft.Aspnetcore.Mvc.Formatters.Json | 1.0.0 |
| Microsoft | Microsoft.Aspnetcore.Mvc.Formatters.Xml | 1.0.0 |
| Microsoft | Microsoft.Aspnetcore.Mvc.Localization | 1.0.0 |
| Microsoft | Microsoft.Aspnetcore.Mvc.Razor | 1.0.0 |
| Microsoft | Microsoft.Aspnetcore.Mvc.Razor.Host | 1.0.0 |
| Microsoft | Microsoft.Aspnetcore.Mvc.Taghelpers | 1.0.0 |
| Microsoft | Microsoft.Aspnetcore.Mvc.Viewfeatures | 1.0.0 |
| Microsoft | Microsoft.Aspnetcore.Mvc.Webapicompatshim | 1.0.0 |
| Microsoft | System.Net.Http | 4.1.1 |
| Microsoft | System.Net.Http.Winhttphandler | 4.0.1 |
| Microsoft | System.Net.Security | 4.0.0 |
| Microsoft | System.Net.Websockets.Client | 4.0.0 |
| Microsoft | System.Text.Encodings.Web | 4.0.0 |
Related Weaknesses (CWE)
References
- https://github.com/aspnet/Announcements/issues/239Technical DescriptionThird Party Advisory
- https://github.com/aspnet/Announcements/issues/239Technical DescriptionThird Party Advisory
FAQ
What is CVE-2017-0256?
CVE-2017-0256 is a vulnerability with a CVSS score of 5.3 (MEDIUM). A spoofing vulnerability exists when the ASP.NET Core fails to properly sanitize web requests.
How severe is CVE-2017-0256?
CVE-2017-0256 has been rated MEDIUM with a CVSS base score of 5.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2017-0256?
Check the references section above for vendor advisories and patch information. Affected products include: Microsoft Asp.Net Model View Controller, Microsoft Microsoft.Aspnetcore.Mvc.Abstractions, Microsoft Microsoft.Aspnetcore.Mvc.Apiexplorer, Microsoft Microsoft.Aspnetcore.Mvc.Cors, Microsoft Microsoft.Aspnetcore.Mvc.Dataannotations.