{"id":"CVE-2017-0249","aliases":["EUVD-2018-0665","GHSA-qhqf-ghgh-x2m4"],"status":"published","title":"High severity vulnerability that affects Microsoft.AspNetCore.Mvc","description":"An elevation of privilege vulnerability exists when the ASP.NET Core fails to properly sanitize web requests.","severity":{"version":"3.0","score":7.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.04249,"percentile":0.91109,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20"],"published":"2017-05-12T14:00:00Z","modified":"2026-06-17T00:57:20Z","fixes":[{"ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc","fixed_in":["1.1.3","1.0.4"],"sources":["ghsa","osv"]},{"ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.Core","fixed_in":["1.0.4","1.1.3"],"sources":["ghsa","osv"]},{"ecosystem":"NuGet","package":"System.Net.Http","fixed_in":["4.1.2","4.3.2"],"sources":["ghsa","osv"]},{"ecosystem":"NuGet","package":"System.Text.Encodings.Web","fixed_in":["4.0.1","4.3.1"],"sources":["ghsa","osv"]},{"ecosystem":"NuGet","package":"System.Net.Http.WinHttpHandler","fixed_in":["4.0.1","4.3.1"],"sources":["ghsa","osv"]},{"ecosystem":"NuGet","package":"System.Net.Security","fixed_in":["4.0.1","4.3.1"],"sources":["ghsa","osv"]},{"ecosystem":"NuGet","package":"System.Net.WebSockets.Client","fixed_in":["4.0.1","4.3.1"],"sources":["ghsa","osv"]},{"ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.Abstractions","fixed_in":["1.0.4","1.1.3"],"sources":["ghsa","osv"]},{"ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.ApiExplorer","fixed_in":["1.0.4","1.1.3"],"sources":["ghsa","osv"]},{"ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.Cors","fixed_in":["1.0.4","1.1.3"],"sources":["ghsa","osv"]},{"ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.DataAnnotations","fixed_in":["1.0.4","1.1.3"],"sources":["ghsa","osv"]},{"ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.Formatters.Json","fixed_in":["1.0.4","1.1.3"],"sources":["ghsa","osv"]},{"ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.Formatters.Xml","fixed_in":["1.0.4","1.1.3"],"sources":["ghsa","osv"]},{"ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.Localization","fixed_in":["1.0.4","1.1.3"],"sources":["ghsa","osv"]},{"ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.Razor.Host","fixed_in":["1.0.4","1.1.3"],"sources":["ghsa","osv"]},{"ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.Razor","fixed_in":["1.0.4","1.1.3"],"sources":["ghsa","osv"]},{"ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.TagHelpers","fixed_in":["1.0.4","1.1.3"],"sources":["ghsa","osv"]},{"ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.ViewFeatures","fixed_in":["1.0.4","1.1.3"],"sources":["ghsa","osv"]},{"ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.WebApiCompatShim","fixed_in":["1.0.4","1.1.3"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.0"},{"fixed":"1.1.3"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.4"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.Core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.4"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.Core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.0"},{"fixed":"1.1.3"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"System.Net.Http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.1"},{"last_affected":"4.1.1"},{"fixed":"4.1.2"}]}],"versions":["4.1.1"]},{"source":"ghsa","ecosystem":"NuGet","package":"System.Net.Http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.3.1"},{"last_affected":"4.3.1"},{"fixed":"4.3.2"}]}],"versions":["4.3.1"]},{"source":"ghsa","ecosystem":"NuGet","package":"System.Text.Encodings.Web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"last_affected":"4.0.0"},{"fixed":"4.0.1"}]}],"versions":["4.0.0"]},{"source":"ghsa","ecosystem":"NuGet","package":"System.Text.Encodings.Web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.3.0"},{"last_affected":"4.3.0"},{"fixed":"4.3.1"}]}],"versions":["4.3.0"]},{"source":"ghsa","ecosystem":"NuGet","package":"System.Net.Http.WinHttpHandler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"last_affected":"4.0.0"},{"fixed":"4.0.1"}]}],"versions":["4.0.0"]},{"source":"ghsa","ecosystem":"NuGet","package":"System.Net.Http.WinHttpHandler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.3.0"},{"last_affected":"4.3.0"},{"fixed":"4.3.1"}]}],"versions":["4.3.0"]},{"source":"ghsa","ecosystem":"NuGet","package":"System.Net.Security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"last_affected":"4.0.0"},{"fixed":"4.0.1"}]}],"versions":["4.0.0"]},{"source":"ghsa","ecosystem":"NuGet","package":"System.Net.Security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.3.0"},{"last_affected":"4.3.0"},{"fixed":"4.3.1"}]}],"versions":["4.3.0"]},{"source":"ghsa","ecosystem":"NuGet","package":"System.Net.WebSockets.Client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"last_affected":"4.0.0"},{"fixed":"4.0.1"}]}],"versions":["4.0.0"]},{"source":"ghsa","ecosystem":"NuGet","package":"System.Net.WebSockets.Client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.3.0"},{"last_affected":"4.3.0"},{"fixed":"4.3.1"}]}],"versions":["4.3.0"]},{"source":"ghsa","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.Abstractions","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.4"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.Abstractions","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.0"},{"fixed":"1.1.3"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.ApiExplorer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.4"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.ApiExplorer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.0"},{"fixed":"1.1.3"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.Cors","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.4"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.Cors","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.0"},{"fixed":"1.1.3"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.DataAnnotations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.4"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.DataAnnotations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.0"},{"fixed":"1.1.3"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.Formatters.Json","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.4"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.Formatters.Json","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.0"},{"fixed":"1.1.3"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.Formatters.Xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.4"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.Formatters.Xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.0"},{"fixed":"1.1.3"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.Localization","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.4"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.Localization","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.0"},{"fixed":"1.1.3"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.Razor.Host","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.4"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.Razor.Host","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.0"},{"fixed":"1.1.3"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.Razor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.4"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.Razor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.0"},{"fixed":"1.1.3"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.TagHelpers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.4"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.TagHelpers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.0"},{"fixed":"1.1.3"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.ViewFeatures","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.4"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.ViewFeatures","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.0"},{"fixed":"1.1.3"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.WebApiCompatShim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.4"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.WebApiCompatShim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.0"},{"fixed":"1.1.3"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"DisCatSharp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"9.8.3"}]}]},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.4"}]}],"versions":["1.0.0","1.0.1","1.0.2","1.0.3"]},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.0"},{"fixed":"1.1.3"}]}],"versions":["1.1.0","1.1.1","1.1.2"]},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.Core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.4"}]}],"versions":["1.0.0","1.0.1","1.0.2","1.0.3"]},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.Core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.0"},{"fixed":"1.1.3"}]}],"versions":["1.1.0","1.1.1","1.1.2"]},{"source":"osv","ecosystem":"NuGet","package":"System.Net.Http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.1"},{"fixed":"4.1.2"}]}],"versions":["4.1.1"]},{"source":"osv","ecosystem":"NuGet","package":"System.Net.Http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.3.1"},{"fixed":"4.3.2"}]}],"versions":["4.3.1"]},{"source":"osv","ecosystem":"NuGet","package":"System.Text.Encodings.Web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.0.1"}]}],"versions":["4.0.0"]},{"source":"osv","ecosystem":"NuGet","package":"System.Text.Encodings.Web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.3.0"},{"fixed":"4.3.1"}]}],"versions":["4.3.0"]},{"source":"osv","ecosystem":"NuGet","package":"System.Net.Http.WinHttpHandler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.0.1"}]}],"versions":["4.0.0"]},{"source":"osv","ecosystem":"NuGet","package":"System.Net.Http.WinHttpHandler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.3.0"},{"fixed":"4.3.1"}]}],"versions":["4.3.0"]},{"source":"osv","ecosystem":"NuGet","package":"System.Net.Security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.0.1"}]}],"versions":["4.0.0"]},{"source":"osv","ecosystem":"NuGet","package":"System.Net.Security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.3.0"},{"fixed":"4.3.1"}]}],"versions":["4.3.0"]},{"source":"osv","ecosystem":"NuGet","package":"System.Net.WebSockets.Client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.0.1"}]}],"versions":["4.0.0"]},{"source":"osv","ecosystem":"NuGet","package":"System.Net.WebSockets.Client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.3.0"},{"fixed":"4.3.1"}]}],"versions":["4.3.0"]},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.Abstractions","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.4"}]}],"versions":["1.0.0","1.0.1","1.0.2","1.0.3"]},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.Abstractions","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.0"},{"fixed":"1.1.3"}]}],"versions":["1.1.0","1.1.1","1.1.2"]},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.ApiExplorer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.4"}]}],"versions":["1.0.0","1.0.1","1.0.2","1.0.3"]},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.ApiExplorer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.0"},{"fixed":"1.1.3"}]}],"versions":["1.1.0","1.1.1","1.1.2"]},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.Cors","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.4"}]}],"versions":["1.0.0","1.0.1","1.0.2","1.0.3"]},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.Cors","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.0"},{"fixed":"1.1.3"}]}],"versions":["1.1.0","1.1.1","1.1.2"]},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.DataAnnotations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.4"}]}],"versions":["1.0.0","1.0.1","1.0.2","1.0.3"]},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.DataAnnotations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.0"},{"fixed":"1.1.3"}]}],"versions":["1.1.0","1.1.1","1.1.2"]},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.Formatters.Json","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.4"}]}],"versions":["1.0.0","1.0.1","1.0.2","1.0.3"]},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.Formatters.Json","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.0"},{"fixed":"1.1.3"}]}],"versions":["1.1.0","1.1.1","1.1.2"]},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.Formatters.Xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.4"}]}],"versions":["1.0.0","1.0.1","1.0.2","1.0.3"]},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.Formatters.Xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.0"},{"fixed":"1.1.3"}]}],"versions":["1.1.0","1.1.1","1.1.2"]},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.Localization","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.4"}]}],"versions":["1.0.0","1.0.1","1.0.2","1.0.3"]},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.Localization","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.0"},{"fixed":"1.1.3"}]}],"versions":["1.1.0","1.1.1","1.1.2"]},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.Razor.Host","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.4"}]}],"versions":["1.0.0","1.0.1","1.0.2","1.0.3"]},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.Razor.Host","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.0"},{"fixed":"1.1.3"}]}],"versions":["1.1.0","1.1.1","1.1.2"]},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.Razor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.4"}]}],"versions":["1.0.0","1.0.1","1.0.2","1.0.3"]},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.Razor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.0"},{"fixed":"1.1.3"}]}],"versions":["1.1.0","1.1.1","1.1.2"]},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.TagHelpers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.4"}]}],"versions":["1.0.0","1.0.1","1.0.2","1.0.3"]},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.TagHelpers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.0"},{"fixed":"1.1.3"}]}],"versions":["1.1.0","1.1.1","1.1.2"]},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.ViewFeatures","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.4"}]}],"versions":["1.0.0","1.0.1","1.0.2","1.0.3"]},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.ViewFeatures","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.0"},{"fixed":"1.1.3"}]}],"versions":["1.1.0","1.1.1","1.1.2"]},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.WebApiCompatShim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.4"}]}],"versions":["1.0.0","1.0.1","1.0.2","1.0.3"]},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.WebApiCompatShim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.0"},{"fixed":"1.1.3"}]}],"versions":["1.1.0","1.1.1","1.1.2"]},{"source":"osv","ecosystem":"NuGet","package":"DisCatSharp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"9.8.3"}]}],"versions":["9.5.8","9.5.8-nightly-00003","9.5.8-nightly-00004","9.5.8-nightly-00183","9.5.8-nightly-00184","9.6.0","9.6.0-nightly-00005","9.6.0-nightly-00008","9.6.0-nightly-00010","9.6.0-nightly-00011","9.6.1","9.6.1-nightly-00012","9.6.1-nightly-00015","9.6.1-nightly-00016","9.6.1-nightly-00017","9.6.1-nightly-00018","9.6.2","9.6.2-nightly-00019","9.6.2-nightly-00020","9.6.2-nightly-00022","9.6.2-nightly-00023","9.6.2-nightly-00025","9.6.2-nightly-00026","9.6.2-nightly-00027","9.6.2-nightly-00028","9.6.2-nightly-00029","9.6.2-nightly-00030","9.6.3-nightly-00034","9.6.3-nightly-00035","9.6.3-nightly-00036","9.6.3-nightly-00037","9.6.3-nightly-00038","9.6.3-nightly-00039","9.6.3-nightly-00041","9.6.3-nightly-00042","9.6.3-nightly-00043","9.6.3-nightly-00044","9.6.3-nightly-00045","9.6.3-nightly-00046","9.6.3-nightly-00047","9.6.3-nightly-00048","9.6.3-nightly-00049","9.6.3-nightly-00050","9.6.3-nightly-00051","9.7.0","9.7.0-nightly-00054","9.7.0-nightly-00055","9.7.0-nightly-00056","9.7.0-nightly-00057","9.7.0-nightly-00058","9.7.0-nightly-00059","9.8.0","9.8.0-nightly-00062","9.8.1-nightly-00063","9.8.1-nightly-00064","9.8.1-nightly-00066","9.8.1-nightly-00067","9.8.1-nightly-00068","9.8.1-nightly-00069","9.8.1-nightly-00070","9.8.2","9.8.2-nightly-00076","9.8.2-nightly-00077","9.8.2-nightly-00078","9.8.2-nightly-00079","9.8.2-nightly-00080","9.8.2-nightly-00081","9.8.2-nightly-00082","9.8.2-nightly-00083","9.8.2-nightly-00084","9.8.2-nightly-00085","9.8.2-nightly-00086","9.8.2-nightly-00087","9.8.2-nightly-00088","9.8.2-nightly-00089","9.8.2-nightly-00090","9.8.2-nightly-00091","9.8.2-nightly-00092","9.8.2-nightly-00095","9.8.2-nightly-00096","9.8.2-nightly-00098","9.8.3","9.8.3-nightly-00099","9.8.3-nightly-00100","9.8.3-nightly-00101","9.8.3-nightly-00102","9.8.3-nightly-00103","9.8.3-nightly-00104","9.8.3-nightly-00105","9.8.3-nightly-00106","9.8.3-nightly-00110","9.8.3-nightly-00111","9.8.3-nightly-00113","9.8.3-nightly-00114","9.8.3-nightly-00115","9.8.3-nightly-00116","9.8.3-nightly-00117","9.8.3-nightly-00118","9.8.3-nightly-00119","9.8.3-nightly-00121","9.8.3-nightly-00122","9.8.3-nightly-00123","9.8.3-nightly-00124","9.8.3-nightly-00125","9.8.3-nightly-00126","9.8.3-nightly-00127","9.8.3-nightly-00128","9.8.3-nightly-00129","9.8.3-nightly-00130","9.8.3-nightly-00131","9.8.3-nightly-00132","9.8.3-nightly-00133","9.8.3-nightly-00134","9.8.3-nightly-00135","9.8.3-nightly-00136","9.8.3-nightly-00137","9.8.3-nightly-00138","9.8.3-nightly-00139","9.8.3-nightly-00140","9.8.3-nightly-00141","9.8.3-nightly-00142","9.8.3-nightly-00143","9.8.3-nightly-00146","9.8.3-nightly-00147","9.8.3-nightly-00149"]}],"products":[{"vendor":"microsoft","product":"asp.net core"},{"vendor":"microsoft","product":"asp.net_model_view_controller"},{"vendor":"microsoft","product":"microsoft.aspnetcore.mvc.abstractions"},{"vendor":"microsoft","product":"microsoft.aspnetcore.mvc.apiexplorer"},{"vendor":"microsoft","product":"microsoft.aspnetcore.mvc.cors"},{"vendor":"microsoft","product":"microsoft.aspnetcore.mvc.dataannotations"},{"vendor":"microsoft","product":"microsoft.aspnetcore.mvc.formatters.json"},{"vendor":"microsoft","product":"microsoft.aspnetcore.mvc.formatters.xml"},{"vendor":"microsoft","product":"microsoft.aspnetcore.mvc.localization"},{"vendor":"microsoft","product":"microsoft.aspnetcore.mvc.razor"},{"vendor":"microsoft","product":"microsoft.aspnetcore.mvc.razor.host"},{"vendor":"microsoft","product":"microsoft.aspnetcore.mvc.taghelpers"},{"vendor":"microsoft","product":"microsoft.aspnetcore.mvc.viewfeatures"},{"vendor":"microsoft","product":"microsoft.aspnetcore.mvc.webapicompatshim"},{"vendor":"microsoft","product":"system.net.http"},{"vendor":"microsoft","product":"system.net.http.winhttphandler"},{"vendor":"microsoft","product":"system.net.security"},{"vendor":"microsoft","product":"system.net.websockets.client"},{"vendor":"microsoft","product":"system.text.encodings.web"},{"vendor":"microsoft corporation","product":"asp.net core"}],"references":[{"url":"https://github.com/aspnet/Announcements/issues/239","tags":["x_refsource_MISC","x_transferred","Technical Description","Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-0249","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-qhqf-ghgh-x2m4","tags":["advisory"]},{"url":"https://github.com/Aiko-IT-Systems/DisCatSharp/security/advisories/GHSA-wj4j-gr3f-cfh7","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2017-0249","description":"An elevation of privilege vulnerability exists when the ASP.NET Core fails to properly sanitize web requests.","status":"published","published":"2017-05-12T14:00:00Z","modified":"2024-08-05T12:55:19.336Z","updated_at":"2026-11-02T14:33:22.381225Z"}],"euvd":[{"id":"EUVD-2018-0665","description":"An elevation of privilege vulnerability exists when the ASP.NET Core fails to properly sanitize web requests.","status":"published","published":"2017-05-12T14:00:00Z","modified":"2024-08-05T12:55:19Z","updated_at":"2026-11-03T02:39:24.815554Z"}],"ghsa":[{"id":"GHSA-qhqf-ghgh-x2m4","title":"High severity vulnerability that affects Microsoft.AspNetCore.Mvc","description":"See https://nvd.nist.gov/vuln/detail/CVE-2017-0249 \u0026 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0249","status":"published","published":"2018-10-16T19:57:38Z","modified":"2023-02-01T05:04:08Z","cvss":[{"version":"3.0","score":7.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:36:32.120868Z"}],"nvd":[{"id":"CVE-2017-0249","description":"An elevation of privilege vulnerability exists when the ASP.NET Core fails to properly sanitize web requests.","status":"published","published":"2017-05-12T14:29:04.003Z","modified":"2026-06-17T00:57:20.503Z","cvss":[{"version":"3.0","score":7.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:03:47.848196Z"}],"osv":[{"id":"GHSA-qhqf-ghgh-x2m4","title":"High severity vulnerability that affects Microsoft.AspNetCore.Mvc","description":"See https://nvd.nist.gov/vuln/detail/CVE-2017-0249 \u0026 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0249","status":"published","published":"2018-10-16T19:57:38Z","modified":"2023-11-08T03:58:40.18576Z","cvss":[{"version":"3.0","score":7.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T15:46:54.760124Z"}]}}