Vulnerability in Microsoft Asp.net Core
CVE-2018-8356
A security feature bypass vulnerability exists when Microsoft .NET Framework components do not correctly validate certificates, aka ".NET Framework Security Feature Bypass Vulnerability." This affects .NET Framework 4.7.2, Microsoft .NET F…
Vulnerability class: Improper Certificate Validation
EPSS: 0.007 (48.8th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.5 (Medium). Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N.
Affected products
- Microsoft Asp.net Core — versions 1.0, 1.1, 2.0
- Microsoft Asp.net_core — versions 1.0, 1.1, 2.0
- Microsoft .Net Framework — versions 3.0 Service Pack 2 on Windows Server 2008 for 32-bit Systems Service Pack 2, 3.0 Service Pack 2 on Windows Server 2008 for Itanium-Based Systems Service Pack 2, 3.0 Service Pack 2 on Windows Server 2008 for x64-based Systems Service Pack 2
- Microsoft .Net Core — versions 1.0, 1.1, 2.0
- Microsoft .Net_core — versions 1.0, 1.1, 2.0
- Microsoft .Net Framework — versions 4.7.2 Developer Pack
- Microsoft .Net_framework — versions 3.0, 3.5, 3.5.1
- Microsoft .Net_framework_developer_pack — versions 4.7.2
- Microsoft Powershell_core — versions 6.0, 6.1
- Microsoft Windows_10 — versions 1607, 1703, 1709
Weakness classification (CWE)
References
- secure@microsoft.com (x_refsource_CONFIRM, Patch, Vendor Advisory)
- secure@microsoft.com (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_BID)
- secure@microsoft.com (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_SECTRACK)
Frequently asked questions
- What is CVE-2018-8356?
- CVE-2018-8356 is a medium-severity vulnerability in Microsoft Asp.net Core, classified under Improper Certificate Validation. CVSS score: 5.5/10. Published 2018-07-11.
- How severe is CVE-2018-8356?
- Medium severity. CVSS v3 base score is 5.5 out of 10.