{"id":"CVE-2017-0248","aliases":["EUVD-2018-0579","GHSA-ch6p-4jcm-h8vh"],"status":"published","title":"Moderate severity vulnerability that affects Microsoft.AspNetCore.Mvc and Microsoft.AspNetCore.Mvc.Core","description":"Microsoft .NET Framework 2.0, 3.5, 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2 and 4.7 allow an attacker to bypass Enhanced Security Usage taggings when they present a certificate that is invalid for a specific use, aka \".NET Security Feature Bypass Vulnerability.\"","severity":{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.0551,"percentile":0.9285,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-295"],"published":"2017-05-12T14:00:00Z","modified":"2026-06-17T00:57:20Z","exploits":[{"source":"pocgithub","id":"rubenmamo/CVE-2017-0248-Test","title":"rubenmamo/CVE-2017-0248-Test","date":"2019-01-29","url":"https://github.com/rubenmamo/CVE-2017-0248-Test"}],"fixes":[{"ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc","fixed_in":["1.0.4","1.1.3"],"sources":["ghsa","osv"]},{"ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.Core","fixed_in":["1.0.4","1.1.3"],"sources":["ghsa","osv"]},{"ecosystem":"NuGet","package":"System.Net.Http","fixed_in":["4.1.2","4.3.2"],"sources":["ghsa","osv"]},{"ecosystem":"NuGet","package":"System.Text.Encodings.Web","fixed_in":["4.0.1","4.3.1"],"sources":["ghsa","osv"]},{"ecosystem":"NuGet","package":"System.Net.Http.WinHttpHandler","fixed_in":["4.0.1","4.3.1"],"sources":["ghsa","osv"]},{"ecosystem":"NuGet","package":"System.Net.Security","fixed_in":["4.0.1","4.3.1"],"sources":["ghsa","osv"]},{"ecosystem":"NuGet","package":"System.Net.WebSockets.Client","fixed_in":["4.0.1","4.3.1"],"sources":["ghsa","osv"]},{"ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.Abstractions","fixed_in":["1.0.4","1.1.3"],"sources":["ghsa","osv"]},{"ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.ApiExplorer","fixed_in":["1.0.4","1.1.3"],"sources":["ghsa","osv"]},{"ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.Cors","fixed_in":["1.0.4","1.1.3"],"sources":["ghsa","osv"]},{"ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.DataAnnotations","fixed_in":["1.0.4","1.1.3"],"sources":["ghsa","osv"]},{"ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.Formatters.Json","fixed_in":["1.0.4","1.1.3"],"sources":["ghsa","osv"]},{"ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.Formatters.Xml","fixed_in":["1.0.4","1.1.3"],"sources":["ghsa","osv"]},{"ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.Localization","fixed_in":["1.0.4","1.1.3"],"sources":["ghsa","osv"]},{"ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.Razor.Host","fixed_in":["1.0.4","1.1.3"],"sources":["ghsa","osv"]},{"ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.Razor","fixed_in":["1.0.4","1.1.3"],"sources":["ghsa","osv"]},{"ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.TagHelpers","fixed_in":["1.0.4","1.1.3"],"sources":["ghsa","osv"]},{"ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.ViewFeatures","fixed_in":["1.0.4","1.1.3"],"sources":["ghsa","osv"]},{"ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.WebApiCompatShim","fixed_in":["1.0.4","1.1.3"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.4"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.0"},{"fixed":"1.1.3"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.Core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.4"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.Core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.0"},{"fixed":"1.1.3"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"System.Net.Http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.1"},{"last_affected":"4.1.1"},{"fixed":"4.1.2"}]}],"versions":["4.1.1"]},{"source":"ghsa","ecosystem":"NuGet","package":"System.Net.Http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.3.1"},{"last_affected":"4.3.1"},{"fixed":"4.3.2"}]}],"versions":["4.3.1"]},{"source":"ghsa","ecosystem":"NuGet","package":"System.Text.Encodings.Web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"last_affected":"4.0.0"},{"fixed":"4.0.1"}]}],"versions":["4.0.0"]},{"source":"ghsa","ecosystem":"NuGet","package":"System.Text.Encodings.Web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.3.0"},{"last_affected":"4.3.0"},{"fixed":"4.3.1"}]}],"versions":["4.3.0"]},{"source":"ghsa","ecosystem":"NuGet","package":"System.Net.Http.WinHttpHandler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"last_affected":"4.0.0"},{"fixed":"4.0.1"}]}],"versions":["4.0.0"]},{"source":"ghsa","ecosystem":"NuGet","package":"System.Net.Http.WinHttpHandler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.3.0"},{"last_affected":"4.3.0"},{"fixed":"4.3.1"}]}],"versions":["4.3.0"]},{"source":"ghsa","ecosystem":"NuGet","package":"System.Net.Security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"last_affected":"4.0.0"},{"fixed":"4.0.1"}]}],"versions":["4.0.0"]},{"source":"ghsa","ecosystem":"NuGet","package":"System.Net.Security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.3.0"},{"last_affected":"4.3.0"},{"fixed":"4.3.1"}]}],"versions":["4.3.0"]},{"source":"ghsa","ecosystem":"NuGet","package":"System.Net.WebSockets.Client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"last_affected":"4.0.0"},{"fixed":"4.0.1"}]}],"versions":["4.0.0"]},{"source":"ghsa","ecosystem":"NuGet","package":"System.Net.WebSockets.Client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.3.0"},{"last_affected":"4.3.0"},{"fixed":"4.3.1"}]}],"versions":["4.3.0"]},{"source":"ghsa","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.Abstractions","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.4"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.Abstractions","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.0"},{"fixed":"1.1.3"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.ApiExplorer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.4"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.ApiExplorer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.0"},{"fixed":"1.1.3"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.Cors","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.4"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.Cors","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.0"},{"fixed":"1.1.3"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.DataAnnotations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.4"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.DataAnnotations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.0"},{"fixed":"1.1.3"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.Formatters.Json","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.4"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.Formatters.Json","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.0"},{"fixed":"1.1.3"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.Formatters.Xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.4"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.Formatters.Xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.0"},{"fixed":"1.1.3"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.Localization","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.4"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.Localization","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.0"},{"fixed":"1.1.3"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.Razor.Host","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.4"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.Razor.Host","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.0"},{"fixed":"1.1.3"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.Razor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.4"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.Razor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.0"},{"fixed":"1.1.3"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.TagHelpers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.4"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.TagHelpers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.0"},{"fixed":"1.1.3"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.ViewFeatures","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.4"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.ViewFeatures","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.0"},{"fixed":"1.1.3"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.WebApiCompatShim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.4"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.WebApiCompatShim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.0"},{"fixed":"1.1.3"}]}]},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.4"}]}],"versions":["1.0.0","1.0.1","1.0.2","1.0.3"]},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.0"},{"fixed":"1.1.3"}]}],"versions":["1.1.0","1.1.1","1.1.2"]},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.Core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.4"}]}],"versions":["1.0.0","1.0.1","1.0.2","1.0.3"]},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.Core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.0"},{"fixed":"1.1.3"}]}],"versions":["1.1.0","1.1.1","1.1.2"]},{"source":"osv","ecosystem":"NuGet","package":"System.Net.Http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.1"},{"fixed":"4.1.2"}]}],"versions":["4.1.1"]},{"source":"osv","ecosystem":"NuGet","package":"System.Net.Http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.3.1"},{"fixed":"4.3.2"}]}],"versions":["4.3.1"]},{"source":"osv","ecosystem":"NuGet","package":"System.Text.Encodings.Web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.0.1"}]}],"versions":["4.0.0"]},{"source":"osv","ecosystem":"NuGet","package":"System.Text.Encodings.Web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.3.0"},{"fixed":"4.3.1"}]}],"versions":["4.3.0"]},{"source":"osv","ecosystem":"NuGet","package":"System.Net.Http.WinHttpHandler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.0.1"}]}],"versions":["4.0.0"]},{"source":"osv","ecosystem":"NuGet","package":"System.Net.Http.WinHttpHandler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.3.0"},{"fixed":"4.3.1"}]}],"versions":["4.3.0"]},{"source":"osv","ecosystem":"NuGet","package":"System.Net.Security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.0.1"}]}],"versions":["4.0.0"]},{"source":"osv","ecosystem":"NuGet","package":"System.Net.Security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.3.0"},{"fixed":"4.3.1"}]}],"versions":["4.3.0"]},{"source":"osv","ecosystem":"NuGet","package":"System.Net.WebSockets.Client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.0.1"}]}],"versions":["4.0.0"]},{"source":"osv","ecosystem":"NuGet","package":"System.Net.WebSockets.Client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.3.0"},{"fixed":"4.3.1"}]}],"versions":["4.3.0"]},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.Abstractions","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.4"}]}],"versions":["1.0.0","1.0.1","1.0.2","1.0.3"]},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.Abstractions","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.0"},{"fixed":"1.1.3"}]}],"versions":["1.1.0","1.1.1","1.1.2"]},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.ApiExplorer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.4"}]}],"versions":["1.0.0","1.0.1","1.0.2","1.0.3"]},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.ApiExplorer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.0"},{"fixed":"1.1.3"}]}],"versions":["1.1.0","1.1.1","1.1.2"]},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.Cors","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.4"}]}],"versions":["1.0.0","1.0.1","1.0.2","1.0.3"]},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.Cors","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.0"},{"fixed":"1.1.3"}]}],"versions":["1.1.0","1.1.1","1.1.2"]},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.DataAnnotations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.4"}]}],"versions":["1.0.0","1.0.1","1.0.2","1.0.3"]},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.DataAnnotations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.0"},{"fixed":"1.1.3"}]}],"versions":["1.1.0","1.1.1","1.1.2"]},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.Formatters.Json","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.4"}]}],"versions":["1.0.0","1.0.1","1.0.2","1.0.3"]},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.Formatters.Json","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.0"},{"fixed":"1.1.3"}]}],"versions":["1.1.0","1.1.1","1.1.2"]},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.Formatters.Xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.4"}]}],"versions":["1.0.0","1.0.1","1.0.2","1.0.3"]},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.Formatters.Xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.0"},{"fixed":"1.1.3"}]}],"versions":["1.1.0","1.1.1","1.1.2"]},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.Localization","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.4"}]}],"versions":["1.0.0","1.0.1","1.0.2","1.0.3"]},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.Localization","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.0"},{"fixed":"1.1.3"}]}],"versions":["1.1.0","1.1.1","1.1.2"]},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.Razor.Host","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.4"}]}],"versions":["1.0.0","1.0.1","1.0.2","1.0.3"]},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.Razor.Host","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.0"},{"fixed":"1.1.3"}]}],"versions":["1.1.0","1.1.1","1.1.2"]},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.Razor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.4"}]}],"versions":["1.0.0","1.0.1","1.0.2","1.0.3"]},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.Razor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.0"},{"fixed":"1.1.3"}]}],"versions":["1.1.0","1.1.1","1.1.2"]},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.TagHelpers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.4"}]}],"versions":["1.0.0","1.0.1","1.0.2","1.0.3"]},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.TagHelpers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.0"},{"fixed":"1.1.3"}]}],"versions":["1.1.0","1.1.1","1.1.2"]},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.ViewFeatures","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.4"}]}],"versions":["1.0.0","1.0.1","1.0.2","1.0.3"]},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.ViewFeatures","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.0"},{"fixed":"1.1.3"}]}],"versions":["1.1.0","1.1.1","1.1.2"]},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.WebApiCompatShim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.4"}]}],"versions":["1.0.0","1.0.1","1.0.2","1.0.3"]},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.WebApiCompatShim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.0"},{"fixed":"1.1.3"}]}],"versions":["1.1.0","1.1.1","1.1.2"]}],"products":[{"vendor":"microsoft","product":".net_framework"},{"vendor":"microsoft corporation","product":"microsoft .net framework"}],"references":[{"url":"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0248","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory","web"]},{"url":"http://www.securityfocus.com/bid/98117","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry"]},{"url":"http://www.securitytracker.com/id/1038458","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-0248","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-ch6p-4jcm-h8vh","tags":["advisory"]},{"url":"https://github.com/aspnet/Announcements/issues/239","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2017-0248","description":"Microsoft .NET Framework 2.0, 3.5, 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2 and 4.7 allow an attacker to bypass Enhanced Security Usage taggings when they present a certificate that is invalid for a specific use, aka \".NET Security Feature Bypass Vulnerability.\"","status":"published","published":"2017-05-12T14:00:00Z","modified":"2024-08-05T12:55:19.143Z","updated_at":"2026-11-02T14:33:22.699876Z"}],"euvd":[{"id":"EUVD-2018-0579","description":"Microsoft .NET Framework 2.0, 3.5, 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2 and 4.7 allow an attacker to bypass Enhanced Security Usage taggings when they present a certificate that is invalid for a specific use, aka \".NET Security Feature Bypass Vulnerability.\"","status":"published","published":"2017-05-12T14:00:00Z","modified":"2024-08-05T12:55:19Z","updated_at":"2026-11-03T02:39:24.815554Z"}],"ghsa":[{"id":"GHSA-ch6p-4jcm-h8vh","title":"Moderate severity vulnerability that affects Microsoft.AspNetCore.Mvc and Microsoft.AspNetCore.Mvc.Core","description":"Microsoft .NET Framework 2.0, 3.5, 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2 and 4.7 allow an attacker to bypass Enhanced Security Usage taggings when they present a certificate that is invalid for a specific use, aka \".NET Security Feature Bypass Vulnerability.\"","status":"published","published":"2018-10-16T19:58:52Z","modified":"2024-02-28T18:48:55Z","cwes":["CWE-295"],"updated_at":"2026-11-02T14:37:38.935144Z"}],"nvd":[{"id":"CVE-2017-0248","description":"Microsoft .NET Framework 2.0, 3.5, 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2 and 4.7 allow an attacker to bypass Enhanced Security Usage taggings when they present a certificate that is invalid for a specific use, aka \".NET Security Feature Bypass Vulnerability.\"","status":"published","published":"2017-05-12T14:29:03.973Z","modified":"2026-06-17T00:57:20.39Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T14:03:47.848196Z"}],"osv":[{"id":"GHSA-ch6p-4jcm-h8vh","title":"Moderate severity vulnerability that affects Microsoft.AspNetCore.Mvc and Microsoft.AspNetCore.Mvc.Core","description":"Microsoft .NET Framework 2.0, 3.5, 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2 and 4.7 allow an attacker to bypass Enhanced Security Usage taggings when they present a certificate that is invalid for a specific use, aka \".NET Security Feature Bypass Vulnerability.\"","status":"published","published":"2018-10-16T19:58:52Z","modified":"2024-12-05T05:37:59.757189Z","cwes":["CWE-295"],"updated_at":"2026-11-02T15:46:44.927642Z"}]}}