CVE-2019-0545
Exposure of Sensitive Information in System.Net.Http
CVE-2019-0545 is a high vulnerability (CVSS 7.5) in Microsoft .net Core, published January 8, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 9.61%, the 95th percentile. Fixed in Microsoft.NETCore.App 2.1.7.
An information disclosure vulnerability exists in .NET Framework and .NET Core which allows bypassing Cross-origin Resource Sharing (CORS) configurations, aka ".NET Framework Information Disclosure Vulnerability." This affects Microsoft .NET Framework 2.0, Microsoft .NET Framework 3.0, Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2, Microsoft .NET Framework 4.5.2, Microsoft .NET Framework 4.6, Microsoft .NET Framework 4.6/4.6.1/4.6.2/4.7/4.7.1/4.7.2, Microsoft .NET Framework 4.7/4.7.1/4.7.2, .NET Core 2.1, Microsoft .NET Framework 4.7.1/4.7.2, Microsoft .NET Framework 3.5, Microsoft .NET Framework 3.5.1, Microsoft .NET Framework 4.6/4.6.1/4.6.2, .NET Core 2.2, Microsoft .NET Framework 4.7.2.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
An information disclosure vulnerability exists in .NET Framework and .NET Core which allows bypassing Cross-origin Resource Sharing (CORS) configurations, aka ".NET Framework Information Disclosure Vulnerability." This affects Microsoft .NET Framework 2.0, Microsoft .NET Framework 3.0, Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2, Microsoft .NET Framework 4.5.2, Microsoft .NET Framework 4.6, Microsoft .NET Framework 4.6/4.6.1/4.6.2/4.7/4.7.1/4.7.2, Microsoft .NET Framework 4.7/4.7.1/4.7.2, .NET Core 2.1, Microsoft .NET Framework 4.7.1/4.7.2, Microsoft .NET Framework 3.5, Microsoft .NET Framework 3.5.1, Microsoft .NET Framework 4.6/4.6.1/4.6.2, .NET Core 2.2, Microsoft .NET Framework 4.7.2.
- Record
CVE-2019-0545- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
CVE List No score
An information disclosure vulnerability exists in .NET Framework and .NET Core which allows bypassing Cross-origin Resource Sharing (CORS) configurations, aka ".NET Framework Information Disclosure Vulnerability." This affects Microsoft .NET Framework 2.0, Microsoft .NET Framework 3.0, Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2, Microsoft .NET Framework 4.5.2, Microsoft .NET Framework 4.6, Microsoft .NET Framework 4.6/4.6.1/4.6.2/4.7/4.7.1/4.7.2, Microsoft .NET Framework 4.7/4.7.1/4.7.2, .NET Core 2.1, Microsoft .NET Framework 4.7.1/4.7.2, Microsoft .NET Framework 3.5, Microsoft .NET Framework 3.5.1, Microsoft .NET Framework 4.6/4.6.1/4.6.2, .NET Core 2.2, Microsoft .NET Framework 4.7.2.
- Record
CVE-2019-0545- Updated
- 2026-11-02
EUVDEUVD-2022-2071 No score
An information disclosure vulnerability exists in .NET Framework and .NET Core which allows bypassing Cross-origin Resource Sharing (CORS) configurations, aka ".NET Framework Information Disclosure Vulnerability." This affects Microsoft .NET Framework 2.0, Microsoft .NET Framework 3.0, Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2, Microsoft .NET Framework 4.5.2, Microsoft .NET Framework 4.6, Microsoft .NET Framework 4.6/4.6.1/4.6.2/4.7/4.7.1/4.7.2, Microsoft .NET Framework 4.7/4.7.1/4.7.2, .NET Core 2.1, Microsoft .NET Framework 4.7.1/4.7.2, Microsoft .NET Framework 3.5, Microsoft .NET Framework 3.5.1, Microsoft .NET Framework 4.6/4.6.1/4.6.2, .NET Core 2.2, Microsoft .NET Framework 4.7.2.
- Record
EUVD-2022-2071- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-2xjx-v99w-gqf3
Exposure of Sensitive Information in System.Net.Http
An information disclosure vulnerability exists in .NET Framework and .NET Core which allows bypassing Cross-origin Resource Sharing (CORS) configurations, aka ".NET Framework Information Disclosure Vulnerability." This affects Microsoft .NET Framework 2.0, Microsoft .NET Framework 3.0, Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2, Microsoft .NET Framework 4.5.2, Microsoft .NET Framework 4.6, Microsoft .NET Framework 4.6/4.6.1/4.6.2/4.7/4.7.1/4.7.2, Microsoft .NET Framework 4.7/4.7.1/4.7.2, .NET Core 2.1, Microsoft .NET Framework 4.7.1/4.7.2, Microsoft .NET Framework 3.5, Microsoft .NET Framework 3.5.1, Microsoft .NET Framework 4.6/4.6.1/4.6.2, .NET Core 2.2, Microsoft .NET Framework 4.7.2.
- Record
GHSA-2xjx-v99w-gqf3- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
OSV
An information disclosure vulnerability exists in .NET Framework and .NET Core which allows bypassing Cross-origin Resource Sharing (CORS) configurations, aka ".NET Framework Information Disclosure Vulnerability." This affects Microsoft .NET Framework 2.0, Microsoft .NET Framework 3.0, Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2, Microsoft .NET Framework 4.5.2, Microsoft .NET Framework 4.6, Microsoft .NET Framework 4.6/4.6.1/4.6.2/4.7/4.7.1/4.7.2, Microsoft .NET Framework 4.7/4.7.1/4.7.2, .NET Core 2.1, Microsoft .NET Framework 4.7.1/4.7.2, Microsoft .NET Framework 3.5, Microsoft .NET Framework 3.5.1, Microsoft .NET Framework 4.6/4.6.1/4.6.2, .NET Core 2.2, Microsoft .NET Framework 4.7.2.
- Record
CVE-2019-0545- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVGHSA-2xjx-v99w-gqf3
Exposure of Sensitive Information in System.Net.Http
An information disclosure vulnerability exists in .NET Framework and .NET Core which allows bypassing Cross-origin Resource Sharing (CORS) configurations, aka ".NET Framework Information Disclosure Vulnerability." This affects Microsoft .NET Framework 2.0, Microsoft .NET Framework 3.0, Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2, Microsoft .NET Framework 4.5.2, Microsoft .NET Framework 4.6, Microsoft .NET Framework 4.6/4.6.1/4.6.2/4.7/4.7.1/4.7.2, Microsoft .NET Framework 4.7/4.7.1/4.7.2, .NET Core 2.1, Microsoft .NET Framework 4.7.1/4.7.2, Microsoft .NET Framework 3.5, Microsoft .NET Framework 3.5.1, Microsoft .NET Framework 4.6/4.6.1/4.6.2, .NET Core 2.2, Microsoft .NET Framework 4.7.2.
- Record
GHSA-2xjx-v99w-gqf3- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
OSVRHSA-2019:0040
Red Hat Security Advisory: .NET Core on Red Hat Enterprise Linux security update
- Record
RHSA-2019:0040- CVSS 3.0
- 5.9 Medium
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
Microsoft.NETCore.AppNuGet |
2.1.0 up to 2.1.7 | 2.1.7 |
Microsoft.NETCore.AppNuGet |
2.2.0 to 2.2.0 | 2.2.1 |
Microsoft.NETCore.AppNuGet |
2.1.0 up to 2.1.7, plus listed versions 2.1.12.1.22.1.32.1.42.1.52.1.6 |
2.1.7 |
Microsoft.NETCore.AppNuGet |
2.2.0 up to 2.2.1 | 2.2.1 |
rh-dotnet21Red Hat:rhel_dotnet:2.1::el7 |
before 0:2.1-6.el7 | 0:2.1-6.el7 |
rh-dotnet21-dotnetRed Hat:rhel_dotnet:2.1::el7 |
before 0:2.1.503-1.el7 | 0:2.1.503-1.el7 |
rh-dotnet21-dotnet-debuginfoRed Hat:rhel_dotnet:2.1::el7 |
before 0:2.1.503-1.el7 | 0:2.1.503-1.el7 |
rh-dotnet21-dotnet-hostRed Hat:rhel_dotnet:2.1::el7 |
before 0:2.1.7-1.el7 | 0:2.1.7-1.el7 |
rh-dotnet21-dotnet-runtime-2.1Red Hat:rhel_dotnet:2.1::el7 |
before 0:2.1.7-1.el7 | 0:2.1.7-1.el7 |
rh-dotnet21-dotnet-sdk-2.1Red Hat:rhel_dotnet:2.1::el7 |
before 0:2.1.503-1.el7 | 0:2.1.503-1.el7 |
Show 11 moreShow less
| Package | Affected | Fixed |
|---|---|---|
rh-dotnet21-dotnet-sdk-2.1.5xxRed Hat:rhel_dotnet:2.1::el7 |
before 0:2.1.503-1.el7 | 0:2.1.503-1.el7 |
rh-dotnet21-runtimeRed Hat:rhel_dotnet:2.1::el7 |
before 0:2.1-6.el7 | 0:2.1-6.el7 |
rh-dotnet22Red Hat:rhel_dotnet:2.2::el7 |
before 0:2.2-2.el7 | 0:2.2-2.el7 |
rh-dotnet22-dotnetRed Hat:rhel_dotnet:2.2::el7 |
before 0:2.2.102-1.el7 | 0:2.2.102-1.el7 |
rh-dotnet22-dotnet-debuginfoRed Hat:rhel_dotnet:2.2::el7 |
before 0:2.2.102-1.el7 | 0:2.2.102-1.el7 |
rh-dotnet22-dotnet-hostRed Hat:rhel_dotnet:2.2::el7 |
before 0:2.2.1-1.el7 | 0:2.2.1-1.el7 |
rh-dotnet22-dotnet-host-fxr-2.2Red Hat:rhel_dotnet:2.2::el7 |
before 0:2.2.1-1.el7 | 0:2.2.1-1.el7 |
rh-dotnet22-dotnet-runtime-2.2Red Hat:rhel_dotnet:2.2::el7 |
before 0:2.2.1-1.el7 | 0:2.2.1-1.el7 |
rh-dotnet22-dotnet-sdk-2.2Red Hat:rhel_dotnet:2.2::el7 |
before 0:2.2.102-1.el7 | 0:2.2.102-1.el7 |
rh-dotnet22-dotnet-sdk-2.2.1xxRed Hat:rhel_dotnet:2.2::el7 |
before 0:2.2.102-1.el7 | 0:2.2.102-1.el7 |
rh-dotnet22-runtimeRed Hat:rhel_dotnet:2.2::el7 |
before 0:2.2-2.el7 | 0:2.2-2.el7 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases, products | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0545
securityfocus.com/bid/106405
access.redhat.com/errata/RHSA-2019:0040
nvd.nist.gov/vuln/detail/CVE-2019-0545
github.com/dotnet/announcements/issues/94
Show 15 moreShow less
bugzilla.redhat.com/show_bug.cgi?id=1660632
security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_0040.json
cve.org/CVERecord?id=CVE-2019-0545