CVE-2018-8292 (High) detected in microsoft.netcore.app.2.0.0.nupkg
Opened this issue · 0 comments
CVE-2018-8292 - High Severity Vulnerability
Vulnerable Library - microsoft.netcore.app.2.0.0.nupkg
A set of .NET API's that are included in the default .NET Core application model. e8b8861ac7faf042c87a5c2f9f2d04c98b69f28d When using NuGet 3.x this package requires at least version 3.4.
Library home page: https://api.nuget.org/packages/microsoft.netcore.app.2.0.0.nupkg
Path to dependency file: /Ghpr.SimpleFileLogger.Core/Ghpr.SimpleFileLogger.csproj
Path to vulnerable library: /home/wss-scanner/.nuget/packages/microsoft.netcore.app/2.0.0/microsoft.netcore.app.2.0.0.nupkg
Dependency Hierarchy:
- ❌ microsoft.netcore.app.2.0.0.nupkg (Vulnerable Library)
Found in HEAD commit: 61c01ea44f52cf09332bbf411ffeb7479870bc5c
Found in base branch: master
Vulnerability Details
An information disclosure vulnerability exists in .NET Core when authentication information is inadvertently exposed in a redirect, aka ".NET Core Information Disclosure Vulnerability." This affects .NET Core 2.1, .NET Core 1.0, .NET Core 1.1, PowerShell Core 6.0.
Publish Date: 2018-10-10
URL: CVE-2018-8292
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: None
- Availability Impact: None
Suggested Fix
Type: Upgrade version
Release Date: 2018-10-10
Fix Resolution: System.Net.Http - 4.3.4;Microsoft.PowerShell.Commands.Utility - 6.1.0-rc.1
Step up your Open Source Security Game with Mend here