Loading HuntDB...
Hunt
Vulnerability Intelligence by wss.sh
Home Daily Briefings High Impact CVEs Recent Exploits KEV Catalog GitHub Advisories Latest Updates Security News
Sign In Sign Up

GHSA-j8f4-2w4p-mhjc

GitHub Security Advisory

Moderate severity vulnerability that affects Microsoft.AspNetCore.Mvc

✓ GitHub Reviewed MODERATE Has CVE
View on GitHub

Advisory Details

A spoofing vulnerability exists when the ASP.NET Core fails to properly sanitize web requests.

Affected Packages

NuGet Microsoft.AspNetCore.Mvc
Affected versions: 1.0.0 (fixed in 1.0.4)
NuGet Microsoft.AspNetCore.Mvc
Affected versions: 1.1.0 (fixed in 1.1.3)
NuGet Microsoft.AspNetCore.Mvc.Core
Affected versions: 1.0.0 (fixed in 1.0.4)
NuGet Microsoft.AspNetCore.Mvc.Core
Affected versions: 1.1.0 (fixed in 1.1.3)
NuGet System.Net.Http
Affected versions: 4.1.1 (fixed in 4.1.2)
NuGet System.Net.Http
Affected versions: 4.3.1 (fixed in 4.3.2)
NuGet System.Text.Encodings.Web
Affected versions: 4.0.0 (fixed in 4.0.1)
NuGet System.Text.Encodings.Web
Affected versions: 4.3.0 (fixed in 4.3.1)
NuGet System.Net.Http.WinHttpHandler
Affected versions: 4.0.0 (fixed in 4.0.1)
NuGet System.Net.Http.WinHttpHandler
Affected versions: 4.3.0 (fixed in 4.3.1)
NuGet System.Net.Security
Affected versions: 4.0.0 (fixed in 4.0.1)
NuGet System.Net.Security
Affected versions: 4.3.0 (fixed in 4.3.1)
NuGet System.Net.WebSockets.Client
Affected versions: 4.0.0 (fixed in 4.0.1)
NuGet System.Net.WebSockets.Client
Affected versions: 4.3.0 (fixed in 4.3.1)
NuGet Microsoft.AspNetCore.Mvc.Abstractions
Affected versions: 1.0.0 (fixed in 1.0.4)
NuGet Microsoft.AspNetCore.Mvc.Abstractions
Affected versions: 1.1.0 (fixed in 1.1.3)
NuGet Microsoft.AspNetCore.Mvc.ApiExplorer
Affected versions: 1.0.0 (fixed in 1.0.4)
NuGet Microsoft.AspNetCore.Mvc.ApiExplorer
Affected versions: 1.1.0 (fixed in 1.1.3)
NuGet Microsoft.AspNetCore.Mvc.Cors
Affected versions: 1.0.0 (fixed in 1.0.4)
NuGet Microsoft.AspNetCore.Mvc.Cors
Affected versions: 1.1.0 (fixed in 1.1.3)
NuGet Microsoft.AspNetCore.Mvc.DataAnnotations
Affected versions: 1.0.0 (fixed in 1.0.4)
NuGet Microsoft.AspNetCore.Mvc.DataAnnotations
Affected versions: 1.1.0 (fixed in 1.1.3)
NuGet Microsoft.AspNetCore.Mvc.Formatters.Json
Affected versions: 1.0.0 (fixed in 1.0.4)
NuGet Microsoft.AspNetCore.Mvc.Formatters.Json
Affected versions: 1.1.0 (fixed in 1.1.3)
NuGet Microsoft.AspNetCore.Mvc.Formatters.Xml
Affected versions: 1.0.0 (fixed in 1.0.4)
NuGet Microsoft.AspNetCore.Mvc.Formatters.Xml
Affected versions: 1.1.0 (fixed in 1.1.3)
NuGet Microsoft.AspNetCore.Mvc.Localization
Affected versions: 1.0.0 (fixed in 1.0.4)
NuGet Microsoft.AspNetCore.Mvc.Localization
Affected versions: 1.1.0 (fixed in 1.1.3)
NuGet Microsoft.AspNetCore.Mvc.Razor.Host
Affected versions: 1.0.0 (fixed in 1.0.4)
NuGet Microsoft.AspNetCore.Mvc.Razor.Host
Affected versions: 1.1.0 (fixed in 1.1.3)
NuGet Microsoft.AspNetCore.Mvc.Razor
Affected versions: 1.0.0 (fixed in 1.0.4)
NuGet Microsoft.AspNetCore.Mvc.Razor
Affected versions: 1.1.0 (fixed in 1.1.3)
NuGet Microsoft.AspNetCore.Mvc.TagHelpers
Affected versions: 1.0.0 (fixed in 1.0.4)
NuGet Microsoft.AspNetCore.Mvc.TagHelpers
Affected versions: 1.1.0 (fixed in 1.1.3)
NuGet Microsoft.AspNetCore.Mvc.ViewFeatures
Affected versions: 1.0.0 (fixed in 1.0.4)
NuGet Microsoft.AspNetCore.Mvc.ViewFeatures
Affected versions: 1.1.0 (fixed in 1.1.3)
NuGet Microsoft.AspNetCore.Mvc.WebApiCompatShim
Affected versions: 1.0.0 (fixed in 1.0.4)
NuGet Microsoft.AspNetCore.Mvc.WebApiCompatShim
Affected versions: 1.1.0 (fixed in 1.1.3)

Related CVEs

CVE-2017-0256

Key Information

GHSA ID
GHSA-j8f4-2w4p-mhjc
Published
October 16, 2018 7:57 PM
Last Modified
July 1, 2021 9:44 PM
CVSS Score
5.0 /10
Primary Ecosystem
NuGet
Primary Package
Microsoft.AspNetCore.Mvc
GitHub Reviewed
✓ Yes

Dataset

Last updated: June 18, 2025 6:25 AM

Data from GitHub Advisory Database. This information is provided for research and educational purposes.