{"id":"CVE-2017-0256","aliases":["EUVD-2018-0627","GHSA-j8f4-2w4p-mhjc"],"status":"published","title":"Moderate severity vulnerability that affects Microsoft.AspNetCore.Mvc","description":"A spoofing vulnerability exists when the ASP.NET Core fails to properly sanitize web requests.","severity":{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.03542,"percentile":0.89365,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20"],"published":"2017-05-12T14:00:00Z","modified":"2026-06-17T00:57:21Z","fixes":[{"ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc","fixed_in":["1.0.4","1.1.3"],"sources":["ghsa","osv"]},{"ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.Core","fixed_in":["1.0.4","1.1.3"],"sources":["ghsa","osv"]},{"ecosystem":"NuGet","package":"System.Net.Http","fixed_in":["4.1.2","4.3.2"],"sources":["ghsa","osv"]},{"ecosystem":"NuGet","package":"System.Text.Encodings.Web","fixed_in":["4.0.1","4.3.1"],"sources":["ghsa","osv"]},{"ecosystem":"NuGet","package":"System.Net.Http.WinHttpHandler","fixed_in":["4.0.1","4.3.1"],"sources":["ghsa","osv"]},{"ecosystem":"NuGet","package":"System.Net.Security","fixed_in":["4.0.1","4.3.1"],"sources":["ghsa","osv"]},{"ecosystem":"NuGet","package":"System.Net.WebSockets.Client","fixed_in":["4.0.1","4.3.1"],"sources":["ghsa","osv"]},{"ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.Abstractions","fixed_in":["1.0.4","1.1.3"],"sources":["ghsa","osv"]},{"ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.ApiExplorer","fixed_in":["1.0.4","1.1.3"],"sources":["ghsa","osv"]},{"ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.Cors","fixed_in":["1.0.4","1.1.3"],"sources":["ghsa","osv"]},{"ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.DataAnnotations","fixed_in":["1.0.4","1.1.3"],"sources":["ghsa","osv"]},{"ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.Formatters.Json","fixed_in":["1.0.4","1.1.3"],"sources":["ghsa","osv"]},{"ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.Formatters.Xml","fixed_in":["1.0.4","1.1.3"],"sources":["ghsa","osv"]},{"ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.Localization","fixed_in":["1.0.4","1.1.3"],"sources":["ghsa","osv"]},{"ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.Razor.Host","fixed_in":["1.0.4","1.1.3"],"sources":["ghsa","osv"]},{"ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.Razor","fixed_in":["1.0.4","1.1.3"],"sources":["ghsa","osv"]},{"ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.TagHelpers","fixed_in":["1.0.4","1.1.3"],"sources":["ghsa","osv"]},{"ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.ViewFeatures","fixed_in":["1.0.4","1.1.3"],"sources":["ghsa","osv"]},{"ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.WebApiCompatShim","fixed_in":["1.0.4","1.1.3"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.4"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.0"},{"fixed":"1.1.3"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.Core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.4"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.Core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.0"},{"fixed":"1.1.3"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"System.Net.Http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.1"},{"last_affected":"4.1.1"},{"fixed":"4.1.2"}]}],"versions":["4.1.1"]},{"source":"ghsa","ecosystem":"NuGet","package":"System.Net.Http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.3.1"},{"last_affected":"4.3.1"},{"fixed":"4.3.2"}]}],"versions":["4.3.1"]},{"source":"ghsa","ecosystem":"NuGet","package":"System.Text.Encodings.Web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"last_affected":"4.0.0"},{"fixed":"4.0.1"}]}],"versions":["4.0.0"]},{"source":"ghsa","ecosystem":"NuGet","package":"System.Text.Encodings.Web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.3.0"},{"last_affected":"4.3.0"},{"fixed":"4.3.1"}]}],"versions":["4.3.0"]},{"source":"ghsa","ecosystem":"NuGet","package":"System.Net.Http.WinHttpHandler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"last_affected":"4.0.0"},{"fixed":"4.0.1"}]}],"versions":["4.0.0"]},{"source":"ghsa","ecosystem":"NuGet","package":"System.Net.Http.WinHttpHandler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.3.0"},{"last_affected":"4.3.0"},{"fixed":"4.3.1"}]}],"versions":["4.3.0"]},{"source":"ghsa","ecosystem":"NuGet","package":"System.Net.Security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"last_affected":"4.0.0"},{"fixed":"4.0.1"}]}],"versions":["4.0.0"]},{"source":"ghsa","ecosystem":"NuGet","package":"System.Net.Security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.3.0"},{"last_affected":"4.3.0"},{"fixed":"4.3.1"}]}],"versions":["4.3.0"]},{"source":"ghsa","ecosystem":"NuGet","package":"System.Net.WebSockets.Client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"last_affected":"4.0.0"},{"fixed":"4.0.1"}]}],"versions":["4.0.0"]},{"source":"ghsa","ecosystem":"NuGet","package":"System.Net.WebSockets.Client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.3.0"},{"last_affected":"4.3.0"},{"fixed":"4.3.1"}]}],"versions":["4.3.0"]},{"source":"ghsa","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.Abstractions","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.4"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.Abstractions","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.0"},{"fixed":"1.1.3"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.ApiExplorer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.4"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.ApiExplorer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.0"},{"fixed":"1.1.3"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.Cors","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.4"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.Cors","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.0"},{"fixed":"1.1.3"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.DataAnnotations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.4"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.DataAnnotations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.0"},{"fixed":"1.1.3"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.Formatters.Json","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.4"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.Formatters.Json","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.0"},{"fixed":"1.1.3"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.Formatters.Xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.4"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.Formatters.Xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.0"},{"fixed":"1.1.3"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.Localization","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.4"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.Localization","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.0"},{"fixed":"1.1.3"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.Razor.Host","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.4"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.Razor.Host","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.0"},{"fixed":"1.1.3"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.Razor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.4"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.Razor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.0"},{"fixed":"1.1.3"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.TagHelpers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.4"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.TagHelpers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.0"},{"fixed":"1.1.3"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.ViewFeatures","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.4"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.ViewFeatures","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.0"},{"fixed":"1.1.3"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.WebApiCompatShim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.4"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.WebApiCompatShim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.0"},{"fixed":"1.1.3"}]}]},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.4"}]}],"versions":["1.0.0","1.0.1","1.0.2","1.0.3"]},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.0"},{"fixed":"1.1.3"}]}],"versions":["1.1.0","1.1.1","1.1.2"]},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.Core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.4"}]}],"versions":["1.0.0","1.0.1","1.0.2","1.0.3"]},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.Core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.0"},{"fixed":"1.1.3"}]}],"versions":["1.1.0","1.1.1","1.1.2"]},{"source":"osv","ecosystem":"NuGet","package":"System.Net.Http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.1"},{"fixed":"4.1.2"}]}],"versions":["4.1.1"]},{"source":"osv","ecosystem":"NuGet","package":"System.Net.Http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.3.1"},{"fixed":"4.3.2"}]}],"versions":["4.3.1"]},{"source":"osv","ecosystem":"NuGet","package":"System.Text.Encodings.Web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.0.1"}]}],"versions":["4.0.0"]},{"source":"osv","ecosystem":"NuGet","package":"System.Text.Encodings.Web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.3.0"},{"fixed":"4.3.1"}]}],"versions":["4.3.0"]},{"source":"osv","ecosystem":"NuGet","package":"System.Net.Http.WinHttpHandler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.0.1"}]}],"versions":["4.0.0"]},{"source":"osv","ecosystem":"NuGet","package":"System.Net.Http.WinHttpHandler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.3.0"},{"fixed":"4.3.1"}]}],"versions":["4.3.0"]},{"source":"osv","ecosystem":"NuGet","package":"System.Net.Security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.0.1"}]}],"versions":["4.0.0"]},{"source":"osv","ecosystem":"NuGet","package":"System.Net.Security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.3.0"},{"fixed":"4.3.1"}]}],"versions":["4.3.0"]},{"source":"osv","ecosystem":"NuGet","package":"System.Net.WebSockets.Client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.0.1"}]}],"versions":["4.0.0"]},{"source":"osv","ecosystem":"NuGet","package":"System.Net.WebSockets.Client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.3.0"},{"fixed":"4.3.1"}]}],"versions":["4.3.0"]},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.Abstractions","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.4"}]}],"versions":["1.0.0","1.0.1","1.0.2","1.0.3"]},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.Abstractions","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.0"},{"fixed":"1.1.3"}]}],"versions":["1.1.0","1.1.1","1.1.2"]},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.ApiExplorer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.4"}]}],"versions":["1.0.0","1.0.1","1.0.2","1.0.3"]},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.ApiExplorer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.0"},{"fixed":"1.1.3"}]}],"versions":["1.1.0","1.1.1","1.1.2"]},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.Cors","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.4"}]}],"versions":["1.0.0","1.0.1","1.0.2","1.0.3"]},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.Cors","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.0"},{"fixed":"1.1.3"}]}],"versions":["1.1.0","1.1.1","1.1.2"]},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.DataAnnotations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.4"}]}],"versions":["1.0.0","1.0.1","1.0.2","1.0.3"]},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.DataAnnotations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.0"},{"fixed":"1.1.3"}]}],"versions":["1.1.0","1.1.1","1.1.2"]},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.Formatters.Json","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.4"}]}],"versions":["1.0.0","1.0.1","1.0.2","1.0.3"]},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.Formatters.Json","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.0"},{"fixed":"1.1.3"}]}],"versions":["1.1.0","1.1.1","1.1.2"]},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.Formatters.Xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.4"}]}],"versions":["1.0.0","1.0.1","1.0.2","1.0.3"]},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.Formatters.Xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.0"},{"fixed":"1.1.3"}]}],"versions":["1.1.0","1.1.1","1.1.2"]},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.Localization","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.4"}]}],"versions":["1.0.0","1.0.1","1.0.2","1.0.3"]},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.Localization","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.0"},{"fixed":"1.1.3"}]}],"versions":["1.1.0","1.1.1","1.1.2"]},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.Razor.Host","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.4"}]}],"versions":["1.0.0","1.0.1","1.0.2","1.0.3"]},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.Razor.Host","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.0"},{"fixed":"1.1.3"}]}],"versions":["1.1.0","1.1.1","1.1.2"]},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.Razor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.4"}]}],"versions":["1.0.0","1.0.1","1.0.2","1.0.3"]},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.Razor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.0"},{"fixed":"1.1.3"}]}],"versions":["1.1.0","1.1.1","1.1.2"]},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.TagHelpers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.4"}]}],"versions":["1.0.0","1.0.1","1.0.2","1.0.3"]},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.TagHelpers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.0"},{"fixed":"1.1.3"}]}],"versions":["1.1.0","1.1.1","1.1.2"]},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.ViewFeatures","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.4"}]}],"versions":["1.0.0","1.0.1","1.0.2","1.0.3"]},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.ViewFeatures","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.0"},{"fixed":"1.1.3"}]}],"versions":["1.1.0","1.1.1","1.1.2"]},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.WebApiCompatShim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.4"}]}],"versions":["1.0.0","1.0.1","1.0.2","1.0.3"]},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Mvc.WebApiCompatShim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.0"},{"fixed":"1.1.3"}]}],"versions":["1.1.0","1.1.1","1.1.2"]}],"products":[{"vendor":"microsoft","product":"asp.net core"},{"vendor":"microsoft","product":"asp.net_model_view_controller"},{"vendor":"microsoft","product":"microsoft.aspnetcore.mvc.abstractions"},{"vendor":"microsoft","product":"microsoft.aspnetcore.mvc.apiexplorer"},{"vendor":"microsoft","product":"microsoft.aspnetcore.mvc.cors"},{"vendor":"microsoft","product":"microsoft.aspnetcore.mvc.dataannotations"},{"vendor":"microsoft","product":"microsoft.aspnetcore.mvc.formatters.json"},{"vendor":"microsoft","product":"microsoft.aspnetcore.mvc.formatters.xml"},{"vendor":"microsoft","product":"microsoft.aspnetcore.mvc.localization"},{"vendor":"microsoft","product":"microsoft.aspnetcore.mvc.razor"},{"vendor":"microsoft","product":"microsoft.aspnetcore.mvc.razor.host"},{"vendor":"microsoft","product":"microsoft.aspnetcore.mvc.taghelpers"},{"vendor":"microsoft","product":"microsoft.aspnetcore.mvc.viewfeatures"},{"vendor":"microsoft","product":"microsoft.aspnetcore.mvc.webapicompatshim"},{"vendor":"microsoft","product":"system.net.http"},{"vendor":"microsoft","product":"system.net.http.winhttphandler"},{"vendor":"microsoft","product":"system.net.security"},{"vendor":"microsoft","product":"system.net.websockets.client"},{"vendor":"microsoft","product":"system.text.encodings.web"},{"vendor":"microsoft corporation","product":"asp.net core"}],"references":[{"url":"https://github.com/aspnet/Announcements/issues/239","tags":["x_refsource_MISC","x_transferred","Technical Description","Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-0256","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-j8f4-2w4p-mhjc","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2017-0256","description":"A spoofing vulnerability exists when the ASP.NET Core fails to properly sanitize web requests.","status":"published","published":"2017-05-12T14:00:00Z","modified":"2024-08-05T12:55:19.325Z","updated_at":"2026-11-02T14:33:22.699876Z"}],"euvd":[{"id":"EUVD-2018-0627","description":"A spoofing vulnerability exists when the ASP.NET Core fails to properly sanitize web requests.","status":"published","published":"2017-05-12T14:00:00Z","modified":"2024-08-05T12:55:19Z","updated_at":"2026-11-03T02:39:24.815554Z"}],"ghsa":[{"id":"GHSA-j8f4-2w4p-mhjc","title":"Moderate severity vulnerability that affects Microsoft.AspNetCore.Mvc","description":"A spoofing vulnerability exists when the ASP.NET Core fails to properly sanitize web requests.","status":"published","published":"2018-10-16T19:57:48Z","modified":"2023-02-01T05:03:44Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:36:31.364752Z"}],"nvd":[{"id":"CVE-2017-0256","description":"A spoofing vulnerability exists when the ASP.NET Core fails to properly sanitize web requests.","status":"published","published":"2017-05-12T14:29:04.457Z","modified":"2026-06-17T00:57:21.07Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:03:47.848196Z"}],"osv":[{"id":"GHSA-j8f4-2w4p-mhjc","title":"Moderate severity vulnerability that affects Microsoft.AspNetCore.Mvc","description":"A spoofing vulnerability exists when the ASP.NET Core fails to properly sanitize web requests.","status":"published","published":"2018-10-16T19:57:48Z","modified":"2023-11-08T03:58:40.30669Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T15:46:50.336262Z"}]}}