GHSA-ch6p-4jcm-h8vh

ghsaUSosv

Moderate severity vulnerability that affects Microsoft.AspNetCore.Mvc and Microsoft.AspNetCore.Mvc.Core

view advisory published 2018-10-16Licence: CC-BY-4.0

Microsoft .NET Framework 2.0, 3.5, 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2 and 4.7 allow an attacker to bypass Enhanced Security Usage taggings when they present a certificate that is invalid for a specific use, aka ".NET Security Feature Bypass Vulnerability."

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2017-0248US	high7.5	5.51% (93rd)	Exploit	2017-05-12
Microsoft .NET Framework 2.0, 3.5, 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2 and 4.7 allow an attacker to bypass Enhanced Security Usage taggings when they present a certificate that is inva…

references

External citations — patches, advisories, analysis.

https://github.com/advisories/GHSA-ch6p-4jcm-h8vhADVISORY
https://github.com/aspnet/Announcements/issues/239WEB
https://nvd.nist.gov/vuln/detail/CVE-2017-0248ADVISORY
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0248WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan