CVE-2018-0787
ASP.NET Core allow an elevation of privilege
8.8
HIGH
CVSS 3.1
EPSS 17.5%
Description
ASP.NET Core 1.0. 1.1, and 2.0 allow an elevation of privilege vulnerability due to how web applications that are created from templates validate web requests, aka "ASP.NET Core Elevation Of Privilege Vulnerability".
How to fix CVE-2018-0787
To remediate CVE-2018-0787, upgrade the affected package to a fixed version below.
- NuGet/Microsoft.AspNetCore.HttpOverrides—upgrade to 2.0.2 or later
- —upgrade to 2.0.2 or later
Is CVE-2018-0787 being exploited?
Moderate — EPSS is 17.5%. Track this CVE but it's not at the top of the prioritisation list.
Affected packages (2)
- >= 2.0.0, < 2.0.2
- >= 2.0.0, < 2.0.2
CVSS scores
| Source | Version | Severity | Vector |
|---|---|---|---|
| osv | CVSS 3.1 | HIGH8.8 | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |