High severity vulnerability that affects Microsoft.AspNetCore.Mvc

published 2017-05-12 9 y ago modified 2026-06-17 4 mo ago also GHSA-qhqf-ghgh-x2m4 , EUVD-2018-0665

cvss: 7.3; version 3.0, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 4.2%; EPSS 4.2% chance of exploitation in 30 days, percentile 91%
public exploits: 0; none known

An elevation of privilege vulnerability exists when the ASP.NET Core fails to properly sanitize web requests.

Patch / fix

fixed in 19

nuget Microsoft.AspNetCore.Mvc 1.0.4, 1.1.3
nuget Microsoft.AspNetCore.Mvc.Core 1.0.4, 1.1.3
nuget System.Net.Http 4.1.2, 4.3.2
nuget System.Text.Encodings.Web 4.0.1, 4.3.1
nuget System.Net.Http.WinHttpHandler 4.0.1, 4.3.1
nuget System.Net.Security 4.0.1, 4.3.1
nuget System.Net.WebSockets.Client 4.0.1, 4.3.1
nuget Microsoft.AspNetCore.Mvc.Abstractions 1.0.4, 1.1.3
nuget Microsoft.AspNetCore.Mvc.ApiExplorer 1.0.4, 1.1.3
nuget Microsoft.AspNetCore.Mvc.Cors 1.0.4, 1.1.3
nuget Microsoft.AspNetCore.Mvc.DataAnnotations 1.0.4, 1.1.3
nuget Microsoft.AspNetCore.Mvc.Formatters.Json 1.0.4, 1.1.3
nuget Microsoft.AspNetCore.Mvc.Formatters.Xml 1.0.4, 1.1.3
nuget Microsoft.AspNetCore.Mvc.Localization 1.0.4, 1.1.3
nuget Microsoft.AspNetCore.Mvc.Razor.Host 1.0.4, 1.1.3
nuget Microsoft.AspNetCore.Mvc.Razor 1.0.4, 1.1.3
nuget Microsoft.AspNetCore.Mvc.TagHelpers 1.0.4, 1.1.3
nuget Microsoft.AspNetCore.Mvc.ViewFeatures 1.0.4, 1.1.3
nuget Microsoft.AspNetCore.Mvc.WebApiCompatShim 1.0.4, 1.1.3

Exploit prediction

4.25% chance of exploitation in the next 30 days, higher than 91% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
NVD	3.0	7.3	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
NVD	2.0	7.5	AV:N/AC:L/Au:N/C:P/I:P/A:P
GitHub	3.0	7.3	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Affected packages

ecosystem	package	affected	fixed in
nuget	Microsoft.AspNetCore.Mvc	>=1.0.0, <1.0.4 >=1.1.0, <1.1.3	1.0.4 1.1.3
nuget	Microsoft.AspNetCore.Mvc.Core	>=1.0.0, <1.0.4 >=1.1.0, <1.1.3	1.0.4 1.1.3
nuget	System.Net.Http	>=4.1.1, <4.1.2 >=4.3.1, <4.3.2	4.1.2 4.3.2
nuget	System.Text.Encodings.Web	>=4.0.0, <4.0.1 >=4.3.0, <4.3.1	4.0.1 4.3.1
nuget	System.Net.Http.WinHttpHandler	>=4.0.0, <4.0.1 >=4.3.0, <4.3.1	4.0.1 4.3.1
nuget	System.Net.Security	>=4.0.0, <4.0.1 >=4.3.0, <4.3.1	4.0.1 4.3.1
nuget	System.Net.WebSockets.Client	>=4.0.0, <4.0.1 >=4.3.0, <4.3.1	4.0.1 4.3.1
nuget	Microsoft.AspNetCore.Mvc.Abstractions	>=1.0.0, <1.0.4 >=1.1.0, <1.1.3	1.0.4 1.1.3
nuget	Microsoft.AspNetCore.Mvc.ApiExplorer	>=1.0.0, <1.0.4 >=1.1.0, <1.1.3	1.0.4 1.1.3
nuget	Microsoft.AspNetCore.Mvc.Cors	>=1.0.0, <1.0.4 >=1.1.0, <1.1.3	1.0.4 1.1.3
nuget	Microsoft.AspNetCore.Mvc.DataAnnotations	>=1.0.0, <1.0.4 >=1.1.0, <1.1.3	1.0.4 1.1.3
nuget	Microsoft.AspNetCore.Mvc.Formatters.Json	>=1.0.0, <1.0.4 >=1.1.0, <1.1.3	1.0.4 1.1.3
nuget	Microsoft.AspNetCore.Mvc.Formatters.Xml	>=1.0.0, <1.0.4 >=1.1.0, <1.1.3	1.0.4 1.1.3
nuget	Microsoft.AspNetCore.Mvc.Localization	>=1.0.0, <1.0.4 >=1.1.0, <1.1.3	1.0.4 1.1.3
nuget	Microsoft.AspNetCore.Mvc.Razor.Host	>=1.0.0, <1.0.4 >=1.1.0, <1.1.3	1.0.4 1.1.3
nuget	Microsoft.AspNetCore.Mvc.Razor	>=1.0.0, <1.0.4 >=1.1.0, <1.1.3	1.0.4 1.1.3
nuget	Microsoft.AspNetCore.Mvc.TagHelpers	>=1.0.0, <1.0.4 >=1.1.0, <1.1.3	1.0.4 1.1.3
nuget	Microsoft.AspNetCore.Mvc.ViewFeatures	>=1.0.0, <1.0.4 >=1.1.0, <1.1.3	1.0.4 1.1.3
nuget	Microsoft.AspNetCore.Mvc.WebApiCompatShim	>=1.0.0, <1.0.4 >=1.1.0, <1.1.3	1.0.4 1.1.3
nuget	DisCatSharp	<=9.8.3	no fix listed

Affected products

Microsoft Corporation ASP.NET Core

Classification

Weakness

CWE-20 Improper Input Validation

References

github.com /aspnet/Announcements/issues/239
web, technical-description, third-party-advisory
github.com /Aiko-IT-Systems/DisCatSharp/security/advisories/GHSA-wj4j-gr3f-cfh7
web
nvd.nist.gov /vuln/detail/CVE-2017-0249
advisory
github.com /advisories/GHSA-qhqf-ghgh-x2m4
advisory

Sources

CVE List CVE-2017-0249
GitHub Advisory GHSA-qhqf-ghgh-x2m4
NVD CVE-2017-0249

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary