CVE-2017-0256

N/A

Published: May 12, 2017 at 02:00 PM UTC

Updated: June 17, 2026 at 12:57 AM UTC

19 products affected across 1 vendorAsp.net Model View ControllerSystem.net.http.winhttphandlerMicrosoft.aspnetcore.mvc.taghelpers

Using ASP.NET Core by Microsoft Corporation?

Get instant alerts when new vulnerabilities affect ASP.NET Core - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

N/A

Exploit prediction

EPSS 4%

Description

A spoofing vulnerability exists when the ASP.NET Core fails to properly sanitize web requests.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Asp.net Model View Controller · Microsoft

95%

1.0.0 1.0.1 1.0.2 1.0.3 1.1.0 1.1.1 1.1.2

Microsoft.aspnetcore.mvc.abstractions · Microsoftnuget

95%

1.0.0 1.0.1 1.0.2 1.0.3 1.1.0 1.1.1 1.1.2

Microsoft.aspnetcore.mvc.apiexplorer · Microsoftnuget

95%

1.0.0 1.0.1 1.0.2 1.0.3 1.1.0 1.1.1 1.1.2

Microsoft.aspnetcore.mvc.cors · Microsoftnuget

95%

1.0.0 1.0.1 1.0.2 1.0.3 1.1.0 1.1.1 1.1.2

Microsoft.aspnetcore.mvc.dataannotations · Microsoftnuget

95%

1.0.0 1.0.1 1.0.2 1.0.3 1.1.0 1.1.1 1.1.2

Microsoft.aspnetcore.mvc.formatters.json · Microsoftnuget

95%

1.0.0 1.0.1 1.0.2 1.0.3 1.1.0 1.1.1 1.1.2

Microsoft.aspnetcore.mvc.formatters.xml · Microsoftnuget

95%

1.0.0 1.0.1 1.0.2 1.0.3 1.1.0 1.1.1 1.1.2

Microsoft.aspnetcore.mvc.localization · Microsoftnuget

95%

1.0.0 1.0.1 1.0.2 1.0.3 1.1.0 1.1.1 1.1.2

Microsoft.aspnetcore.mvc.razor · Microsoftnuget

95%

1.0.0 1.0.1 1.0.2 1.0.3 1.1.0 1.1.1 1.1.2

Microsoft.aspnetcore.mvc.razor.host · Microsoftnuget

95%

1.0.0 1.0.1 1.0.2 1.0.3 1.1.0 1.1.1 1.1.2

Remediation

No guide yet

No remediation guidance has been written for this CVE yet, and no fixed version or vendor advisory is recorded against it.

References (1)

x_refsource_MISCTechnical DescriptionThird Party Advisory

Source: [email protected]

https://github.com/aspnet/Announcements/issues/239

CVSS

5MEDIUM[email protected]

Confidentiality: NONE
Integrity: PARTIAL
Availability: NONE

Vector?

Quick Info

StatusMODIFIED

CWE

CWE-20

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create account Sign in

Free plan, no card