Loading HuntDB...
Hunt
Vulnerability Intelligence by wss.sh
Home Daily Briefings High Impact CVEs Recent Exploits KEV Catalog GitHub Advisories Latest Updates Security News
Sign In Sign Up

GHSA-qhqf-ghgh-x2m4

GitHub Security Advisory

High severity vulnerability that affects Microsoft.AspNetCore.Mvc

✓ GitHub Reviewed HIGH Has CVE
View on GitHub

Advisory Details

See https://nvd.nist.gov/vuln/detail/CVE-2017-0249 & https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0249

Affected Packages

NuGet Microsoft.AspNetCore.Mvc
Affected versions: 1.0.0 (fixed in 1.0.4)
NuGet Microsoft.AspNetCore.Mvc
Affected versions: 1.1.0 (fixed in 1.1.3)
NuGet Microsoft.AspNetCore.Mvc.Core
Affected versions: 1.0.0 (fixed in 1.0.4)
NuGet Microsoft.AspNetCore.Mvc.Core
Affected versions: 1.1.0 (fixed in 1.1.3)
NuGet System.Net.Http
Affected versions: 4.1.1 (fixed in 4.1.2)
NuGet System.Net.Http
Affected versions: 4.3.1 (fixed in 4.3.2)
NuGet System.Text.Encodings.Web
Affected versions: 4.0.0 (fixed in 4.0.1)
NuGet System.Text.Encodings.Web
Affected versions: 4.3.0 (fixed in 4.3.1)
NuGet System.Net.Http.WinHttpHandler
Affected versions: 4.0.0 (fixed in 4.0.1)
NuGet System.Net.Http.WinHttpHandler
Affected versions: 4.3.0 (fixed in 4.3.1)
NuGet System.Net.Security
Affected versions: 4.0.0 (fixed in 4.0.1)
NuGet System.Net.Security
Affected versions: 4.3.0 (fixed in 4.3.1)
NuGet System.Net.WebSockets.Client
Affected versions: 4.0.0 (fixed in 4.0.1)
NuGet System.Net.WebSockets.Client
Affected versions: 4.3.0 (fixed in 4.3.1)
NuGet Microsoft.AspNetCore.Mvc.Abstractions
Affected versions: 1.0.0 (fixed in 1.0.4)
NuGet Microsoft.AspNetCore.Mvc.Abstractions
Affected versions: 1.1.0 (fixed in 1.1.3)
NuGet Microsoft.AspNetCore.Mvc.ApiExplorer
Affected versions: 1.0.0 (fixed in 1.0.4)
NuGet Microsoft.AspNetCore.Mvc.ApiExplorer
Affected versions: 1.1.0 (fixed in 1.1.3)
NuGet Microsoft.AspNetCore.Mvc.Cors
Affected versions: 1.0.0 (fixed in 1.0.4)
NuGet Microsoft.AspNetCore.Mvc.Cors
Affected versions: 1.1.0 (fixed in 1.1.3)
NuGet Microsoft.AspNetCore.Mvc.DataAnnotations
Affected versions: 1.0.0 (fixed in 1.0.4)
NuGet Microsoft.AspNetCore.Mvc.DataAnnotations
Affected versions: 1.1.0 (fixed in 1.1.3)
NuGet Microsoft.AspNetCore.Mvc.Formatters.Json
Affected versions: 1.0.0 (fixed in 1.0.4)
NuGet Microsoft.AspNetCore.Mvc.Formatters.Json
Affected versions: 1.1.0 (fixed in 1.1.3)
NuGet Microsoft.AspNetCore.Mvc.Formatters.Xml
Affected versions: 1.0.0 (fixed in 1.0.4)
NuGet Microsoft.AspNetCore.Mvc.Formatters.Xml
Affected versions: 1.1.0 (fixed in 1.1.3)
NuGet Microsoft.AspNetCore.Mvc.Localization
Affected versions: 1.0.0 (fixed in 1.0.4)
NuGet Microsoft.AspNetCore.Mvc.Localization
Affected versions: 1.1.0 (fixed in 1.1.3)
NuGet Microsoft.AspNetCore.Mvc.Razor.Host
Affected versions: 1.0.0 (fixed in 1.0.4)
NuGet Microsoft.AspNetCore.Mvc.Razor.Host
Affected versions: 1.1.0 (fixed in 1.1.3)
NuGet Microsoft.AspNetCore.Mvc.Razor
Affected versions: 1.0.0 (fixed in 1.0.4)
NuGet Microsoft.AspNetCore.Mvc.Razor
Affected versions: 1.1.0 (fixed in 1.1.3)
NuGet Microsoft.AspNetCore.Mvc.TagHelpers
Affected versions: 1.0.0 (fixed in 1.0.4)
NuGet Microsoft.AspNetCore.Mvc.TagHelpers
Affected versions: 1.1.0 (fixed in 1.1.3)
NuGet Microsoft.AspNetCore.Mvc.ViewFeatures
Affected versions: 1.0.0 (fixed in 1.0.4)
NuGet Microsoft.AspNetCore.Mvc.ViewFeatures
Affected versions: 1.1.0 (fixed in 1.1.3)
NuGet Microsoft.AspNetCore.Mvc.WebApiCompatShim
Affected versions: 1.0.0 (fixed in 1.0.4)
NuGet Microsoft.AspNetCore.Mvc.WebApiCompatShim
Affected versions: 1.1.0 (fixed in 1.1.3)
NuGet DisCatSharp
Affected versions: 0 (last affected: 9.8.3)

Related CVEs

CVE-2017-0249

Key Information

GHSA ID
GHSA-qhqf-ghgh-x2m4
Published
October 16, 2018 7:57 PM
Last Modified
October 8, 2021 9:18 PM
CVSS Score
7.5 /10
Primary Ecosystem
NuGet
Primary Package
Microsoft.AspNetCore.Mvc
GitHub Reviewed
✓ Yes

Dataset

Last updated: June 18, 2025 6:25 AM

Data from GitHub Advisory Database. This information is provided for research and educational purposes.