CVE-2017-0248

Moderate severity vulnerability that affects Microsoft.AspNetCore.Mvc and Microsoft.AspNetCore.Mvc.Core

7.5 HighPublic exploitFix available

Microsoft .NET Framework 2.0, 3.5, 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2 and 4.7 allow an attacker to bypass Enhanced Security Usage taggings when they present a certificate that is invalid for a specific use, aka ".NET Security Feature Bypass Vulnerability."

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: High
Availability: None

Exploit likelihood

5.51%Down 24.6 points since Apr 14, 2021

What each source reports

NVD Score used 7.5

Record: CVE-2017-0248
CVSS 3.0: 7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS 2.0: 5.0 MediumAV:N/AC:L/Au:N/C:N/I:P/A:N
Weakness: CWE-295
Updated: 2026-11-02

CVE List No score

Record: CVE-2017-0248
Updated: 2026-11-02

EUVDEUVD-2018-0579 No score

Record: EUVD-2018-0579
Updated: 2026-11-03

GitHub AdvisoriesGHSA-ch6p-4jcm-h8vh No score

Moderate severity vulnerability that affects Microsoft.AspNetCore.Mvc and Microsoft.AspNetCore.Mvc.Core

Record: GHSA-ch6p-4jcm-h8vh
Weakness: CWE-295
Updated: 2026-11-02

OSVGHSA-ch6p-4jcm-h8vh No score

Moderate severity vulnerability that affects Microsoft.AspNetCore.Mvc and Microsoft.AspNetCore.Mvc.Core

Record: GHSA-ch6p-4jcm-h8vh
Weakness: CWE-295
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`Microsoft.AspNetCore.Mvc` NuGet	1.0.0 up to 1.0.4	1.0.4
`Microsoft.AspNetCore.Mvc` NuGet	1.1.0 up to 1.1.3	1.1.3
`Microsoft.AspNetCore.Mvc.Core` NuGet	1.0.0 up to 1.0.4	1.0.4
`Microsoft.AspNetCore.Mvc.Core` NuGet	1.1.0 up to 1.1.3	1.1.3
`System.Net.Http` NuGet	4.1.1 to 4.1.1	4.1.2
`System.Net.Http` NuGet	4.3.1 to 4.3.1	4.3.2
`System.Text.Encodings.Web` NuGet	4.0.0 to 4.0.0	4.0.1
`System.Text.Encodings.Web` NuGet	4.3.0 to 4.3.0	4.3.1
`System.Net.Http.WinHttpHandler` NuGet	4.0.0 to 4.0.0	4.0.1
`System.Net.Http.WinHttpHandler` NuGet	4.3.0 to 4.3.0	4.3.1

Show 66 moreShow less

Affected packages
Package	Affected	Fixed
`System.Net.Security` NuGet	4.0.0 to 4.0.0	4.0.1
`System.Net.Security` NuGet	4.3.0 to 4.3.0	4.3.1
`System.Net.WebSockets.Client` NuGet	4.0.0 to 4.0.0	4.0.1
`System.Net.WebSockets.Client` NuGet	4.3.0 to 4.3.0	4.3.1
`Microsoft.AspNetCore.Mvc.Abstractions` NuGet	1.0.0 up to 1.0.4	1.0.4
`Microsoft.AspNetCore.Mvc.Abstractions` NuGet	1.1.0 up to 1.1.3	1.1.3
`Microsoft.AspNetCore.Mvc.ApiExplorer` NuGet	1.0.0 up to 1.0.4	1.0.4
`Microsoft.AspNetCore.Mvc.ApiExplorer` NuGet	1.1.0 up to 1.1.3	1.1.3
`Microsoft.AspNetCore.Mvc.Cors` NuGet	1.0.0 up to 1.0.4	1.0.4
`Microsoft.AspNetCore.Mvc.Cors` NuGet	1.1.0 up to 1.1.3	1.1.3
`Microsoft.AspNetCore.Mvc.DataAnnotations` NuGet	1.0.0 up to 1.0.4	1.0.4
`Microsoft.AspNetCore.Mvc.DataAnnotations` NuGet	1.1.0 up to 1.1.3	1.1.3
`Microsoft.AspNetCore.Mvc.Formatters.Json` NuGet	1.0.0 up to 1.0.4	1.0.4
`Microsoft.AspNetCore.Mvc.Formatters.Json` NuGet	1.1.0 up to 1.1.3	1.1.3
`Microsoft.AspNetCore.Mvc.Formatters.Xml` NuGet	1.0.0 up to 1.0.4	1.0.4
`Microsoft.AspNetCore.Mvc.Formatters.Xml` NuGet	1.1.0 up to 1.1.3	1.1.3
`Microsoft.AspNetCore.Mvc.Localization` NuGet	1.0.0 up to 1.0.4	1.0.4
`Microsoft.AspNetCore.Mvc.Localization` NuGet	1.1.0 up to 1.1.3	1.1.3
`Microsoft.AspNetCore.Mvc.Razor.Host` NuGet	1.0.0 up to 1.0.4	1.0.4
`Microsoft.AspNetCore.Mvc.Razor.Host` NuGet	1.1.0 up to 1.1.3	1.1.3
`Microsoft.AspNetCore.Mvc.Razor` NuGet	1.0.0 up to 1.0.4	1.0.4
`Microsoft.AspNetCore.Mvc.Razor` NuGet	1.1.0 up to 1.1.3	1.1.3
`Microsoft.AspNetCore.Mvc.TagHelpers` NuGet	1.0.0 up to 1.0.4	1.0.4
`Microsoft.AspNetCore.Mvc.TagHelpers` NuGet	1.1.0 up to 1.1.3	1.1.3
`Microsoft.AspNetCore.Mvc.ViewFeatures` NuGet	1.0.0 up to 1.0.4	1.0.4
`Microsoft.AspNetCore.Mvc.ViewFeatures` NuGet	1.1.0 up to 1.1.3	1.1.3
`Microsoft.AspNetCore.Mvc.WebApiCompatShim` NuGet	1.0.0 up to 1.0.4	1.0.4
`Microsoft.AspNetCore.Mvc.WebApiCompatShim` NuGet	1.1.0 up to 1.1.3	1.1.3
`Microsoft.AspNetCore.Mvc` NuGet	1.0.0 up to 1.0.4, plus listed versions 1.0.11.0.21.0.3	1.0.4
`Microsoft.AspNetCore.Mvc` NuGet	1.1.0 up to 1.1.3, plus listed versions 1.1.11.1.2	1.1.3
`Microsoft.AspNetCore.Mvc.Core` NuGet	1.0.0 up to 1.0.4, plus listed versions 1.0.11.0.21.0.3	1.0.4
`Microsoft.AspNetCore.Mvc.Core` NuGet	1.1.0 up to 1.1.3, plus listed versions 1.1.11.1.2	1.1.3
`System.Net.Http` NuGet	4.1.1 up to 4.1.2	4.1.2
`System.Net.Http` NuGet	4.3.1 up to 4.3.2	4.3.2
`System.Text.Encodings.Web` NuGet	4.0.0 up to 4.0.1	4.0.1
`System.Text.Encodings.Web` NuGet	4.3.0 up to 4.3.1	4.3.1
`System.Net.Http.WinHttpHandler` NuGet	4.0.0 up to 4.0.1	4.0.1
`System.Net.Http.WinHttpHandler` NuGet	4.3.0 up to 4.3.1	4.3.1
`System.Net.Security` NuGet	4.0.0 up to 4.0.1	4.0.1
`System.Net.Security` NuGet	4.3.0 up to 4.3.1	4.3.1
`System.Net.WebSockets.Client` NuGet	4.0.0 up to 4.0.1	4.0.1
`System.Net.WebSockets.Client` NuGet	4.3.0 up to 4.3.1	4.3.1
`Microsoft.AspNetCore.Mvc.Abstractions` NuGet	1.0.0 up to 1.0.4, plus listed versions 1.0.11.0.21.0.3	1.0.4
`Microsoft.AspNetCore.Mvc.Abstractions` NuGet	1.1.0 up to 1.1.3, plus listed versions 1.1.11.1.2	1.1.3
`Microsoft.AspNetCore.Mvc.ApiExplorer` NuGet	1.0.0 up to 1.0.4, plus listed versions 1.0.11.0.21.0.3	1.0.4
`Microsoft.AspNetCore.Mvc.ApiExplorer` NuGet	1.1.0 up to 1.1.3, plus listed versions 1.1.11.1.2	1.1.3
`Microsoft.AspNetCore.Mvc.Cors` NuGet	1.0.0 up to 1.0.4, plus listed versions 1.0.11.0.21.0.3	1.0.4
`Microsoft.AspNetCore.Mvc.Cors` NuGet	1.1.0 up to 1.1.3, plus listed versions 1.1.11.1.2	1.1.3
`Microsoft.AspNetCore.Mvc.DataAnnotations` NuGet	1.0.0 up to 1.0.4, plus listed versions 1.0.11.0.21.0.3	1.0.4
`Microsoft.AspNetCore.Mvc.DataAnnotations` NuGet	1.1.0 up to 1.1.3, plus listed versions 1.1.11.1.2	1.1.3
`Microsoft.AspNetCore.Mvc.Formatters.Json` NuGet	1.0.0 up to 1.0.4, plus listed versions 1.0.11.0.21.0.3	1.0.4
`Microsoft.AspNetCore.Mvc.Formatters.Json` NuGet	1.1.0 up to 1.1.3, plus listed versions 1.1.11.1.2	1.1.3
`Microsoft.AspNetCore.Mvc.Formatters.Xml` NuGet	1.0.0 up to 1.0.4, plus listed versions 1.0.11.0.21.0.3	1.0.4
`Microsoft.AspNetCore.Mvc.Formatters.Xml` NuGet	1.1.0 up to 1.1.3, plus listed versions 1.1.11.1.2	1.1.3
`Microsoft.AspNetCore.Mvc.Localization` NuGet	1.0.0 up to 1.0.4, plus listed versions 1.0.11.0.21.0.3	1.0.4
`Microsoft.AspNetCore.Mvc.Localization` NuGet	1.1.0 up to 1.1.3, plus listed versions 1.1.11.1.2	1.1.3
`Microsoft.AspNetCore.Mvc.Razor.Host` NuGet	1.0.0 up to 1.0.4, plus listed versions 1.0.11.0.21.0.3	1.0.4
`Microsoft.AspNetCore.Mvc.Razor.Host` NuGet	1.1.0 up to 1.1.3, plus listed versions 1.1.11.1.2	1.1.3
`Microsoft.AspNetCore.Mvc.Razor` NuGet	1.0.0 up to 1.0.4, plus listed versions 1.0.11.0.21.0.3	1.0.4
`Microsoft.AspNetCore.Mvc.Razor` NuGet	1.1.0 up to 1.1.3, plus listed versions 1.1.11.1.2	1.1.3
`Microsoft.AspNetCore.Mvc.TagHelpers` NuGet	1.0.0 up to 1.0.4, plus listed versions 1.0.11.0.21.0.3	1.0.4
`Microsoft.AspNetCore.Mvc.TagHelpers` NuGet	1.1.0 up to 1.1.3, plus listed versions 1.1.11.1.2	1.1.3
`Microsoft.AspNetCore.Mvc.ViewFeatures` NuGet	1.0.0 up to 1.0.4, plus listed versions 1.0.11.0.21.0.3	1.0.4
`Microsoft.AspNetCore.Mvc.ViewFeatures` NuGet	1.1.0 up to 1.1.3, plus listed versions 1.1.11.1.2	1.1.3
`Microsoft.AspNetCore.Mvc.WebApiCompatShim` NuGet	1.0.0 up to 1.0.4, plus listed versions 1.0.11.0.21.0.3	1.0.4
`Microsoft.AspNetCore.Mvc.WebApiCompatShim` NuGet	1.1.0 up to 1.1.3, plus listed versions 1.1.11.1.2	1.1.3

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
PoC in GitHub	rubenmamo/CVE-2017-0248-Test	2019-01-29

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2017-0248 is a high vulnerability (CVSS 7.5) in Microsoft .net Framework, published May 12, 2017. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 5.51%, the 92nd percentile. Fixed in Microsoft.AspNetCore.Mvc 1.0.4.